MAL-2026-13981 Malicious code in eslint-publish-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3befb9fa08cae88e2ebcfb7877a33453bc0b95e0876fb5f76d55b011c8c9869 [email protected] is a hollow package index.js is an empty stub, no lifecycle scripts whose only effect on install is dependency...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release

Red Hat build of OpenTelemetry 3.10.2 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...

ROOT-APP-MAVEN-CVE-2026-39304 CVE-2026-39304 in org.apache.activemq:activemq-client - Patched by Root

Root has patched CVE-2026-39304 in the org.apache.activemq:activemq-client package for Root:Maven. Multiple fixed versions available...

CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

EUVD-2026-58156

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428

The Git repository management system Gitea is vulnerable to an attachment extension allowlist bypass via the web release edit form. An authenticated remote attacker with repository write permissions can exploit flaws in the EditReleasePost() function (in routers/web/repo/release.go) and the Updat...

CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

SUSE CVE-2026-68180

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...

Malicious Package

Overview eslint-publish-release is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

RHSA-2026:54508 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CLSA-2026-1786607229 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 5 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.10...

CVE-2026-58428: Improper Protection of Alternate Path

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

The vulnerability of the Linux operating system’s kernel Bluetooth module, allowing a hacker to trigger a service failure

The vulnerability of the Linux operating system’s kernel Bluetooth module is related to premature resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the dma/at_hdmac.c component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the dma/athdmac.c component in the Linux operating system is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

CLSA-2026-1786573855 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 3 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.8...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-68755

A bundle writer may create misleading release promotion information under specific conditions...

EUVD-2026-57257

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

CVE-2026-65926

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...