CVE-2026-45799

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

ROS-20260907-73-0031

The vulnerability of the runc command, used to execute isolated containers, is related to the state of the race condition that allows for the tracking of references. Exploiting this vulnerability could enable a hacker to compromise the confidentiality, integrity, and accessibility of the protecte...

Malicious code in decorator-runtime-advance (npm)

The package decorator-runtime-advance was found to contain malicious code. --- Credit: OpenSSF source...

EUVD-2022-56036

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053264)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053264 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053220)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053220 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device an...

SUSE CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

The hidden work of modernizing Malwarebytes

Most of the work that keeps a security product trustworthy is invisible. Users see a scan complete, a threat blocked, an update applied overnight. They don’t see the platform underneath. Runtimes, managed libraries, native drivers, and Windows requirements must all stay current and work together...

Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products

Several vulnerabilities in the Wibu Systems CodeMeter Runtime affect the SICK products Sentio Creator, Sentio Compose, Safety Designer, Stream Editor, CODE-LOC, LiDAR-LOC, PLB, SIM1200-2A1A130 LiDAR-LOC and multiple SICK Industrial PCs APU0G00, APU0G50, APU0G03, APU3F00, APU4600, APU8G00 and...

Security update for podman

This update for podman rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...

Malicious code in container-async-awk-zeta-runtime (npm)

Source: amazon-inspector 082ad9eaa7013935b76f49b8c891ae47917346f7ad1ac35faa8cee452b2338e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cloud-runtime (npm)

The package cloud-runtime was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cloud-runtime-authorization (npm)

The package cloud-runtime-authorization was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cloud-class-stack-xml-runtime (npm)

Source: amazon-inspector 233273838b0bc9fcd5abb46cd15a57798f84aacac1be400324b3c6b7173ae244 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in circuit-runtime (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-runtime-ui (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-runtime-ui-test (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-runtime-screen-test (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-runtime-presenter-test (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-runtime-presenter (npm)

Source: ossf-package-analysis 3cdb658ec8c6d8d9af631260f52c7b97315d6714449b7e8bcd8ac60e65644951 The OpenSSF Package Analysis project identified 'circuit-runtime-presenter' @ 10.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...