Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...

Malware in node-runtime-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-14313 Malicious code in node-runtime-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac7a39a8896a7f78a20fe79758f146d2158f2fc529e51ac705720a745552770 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview @evial/runtime-health is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview runtime-health is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-runtime-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by CVE-2026-76229 via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: CVE-2026-76229 Source advisory: MEND:CVE-2026-76229...

@jamietanna/renovate-graph (>=0.36.0, <=0.37.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by CVE-2026-76227 via renovate (>=42.92.4, <=42.99.0)

renovate NPM version =42.92.4, =0.36.0, =0.37.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves: CVE-2026-76227 Source advisory: MEND:CVE-2026-76227...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (4.0.1) potentially affected by CVE-2026-76226 via renovate (43.77.2)

renovate NPM version 43.77.2 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 4.0.1 Source cves: CVE-2026-76226 Source advisory: MEND:CVE-2026-76226...

coiled-runtime (>=0.1.0, <=0.1.1), trubrics (0.0.2) potentially affected by CVE-2026-73415 via jupyterlab (3.4.2)

jupyterlab PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - coiled-runtime =0.1.0, =0.1.1 - trubrics 0.0.2 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...

arbor-ai (0.1.13), coreason-runtime (>=0.1.0, <=0.10.8) +7 more potentially affected by CVE-2026-10775 via sglang (>=0.1.26, <=0.5.2)

sglang PYPI version =0.1.26, =0.1.0, =1.1.0rc1, =0.4.0, =0.0.1, =0.0.1.post1, =0.0.0, =0.8.0, =0.10.9 Source cves: CVE-2026-10775 Source advisory: OSV:PYSEC-2026-3695...

CVE-2026-72260

A flaw was found in the Advanced Linux Sound Architecture ALSA System on Chip ASoC Mediatek MT8192 audio driver in the Linux kernel. During the device probe process, the driver fails to properly check the return value of a runtime power management PM function. If the runtime resume operation fail...

Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

MAL-2026-14250 Malicious code in luluking1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...

[SECURITY] Fedora 44 Update: python3.14-3.14.7-1.fc44

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

Malicious code in @evial/runtime-health (npm)

Source: amazon-inspector 59022bd399abaafea3b730e96ba9cc0252dbf18266f6f14200e0b1b6f1feba6f The package's package.json declares postinstall: node -e "require'./scripts/lodash.js'" and sets the same file as main, so the payload runs both on npm install and on require'@evial/runtime-health'...

CVE-2026-16661: Integer Overflow or Wraparound

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability,...

CVE-2026-17100: Out-of-bounds Write

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 - OP940.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access ...

PT-2026-78588

Name of the Vulnerable Software and Affected Versions IBM PowerVM Hypervisor version FW1120.00 IBM PowerVM Hypervisor versions FW1110.00 through FW1110.30 IBM PowerVM Hypervisor versions FW1060.00 through FW1060.80 IBM PowerVM Hypervisor versions FW950.00 through FW950.H2 Description A flaw exist...