PT-2026-55996

Name of the Vulnerable Software and Affected Versions DNG SDK versions 1.7.1 2536 and earlier Description A NULL Pointer Dereference occurs when the software attempts to read from a memory address that is NULL, causing the application to crash. This issue can lead to a denial-of-service condition...

MAL-2026-6738 Malicious code in @jacobtan/decode-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a99e8b0d7812c216410fc0ff557698f61a595d4ded8579c18fab63ab3ac8b924 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@grackle-ai/cli (>=0.82.2, <=0.132.2), @grackle-ai/powerline (>=0.82.2, <=0.132.2) +6 more potentially affected by unknown CVE via @grackle-ai/runtime-sdk (>=0.82.2, <=0.132.2)

@grackle-ai/runtime-sdk NPM version =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.132.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIRUNTIMESDK-17817938...

GHSA-VV65-F55V-XM6G Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

Summary The default git executor used for all worktree operations spawns git through a shell, and the untrusted task branch name flows into the command unsanitized. A caller able to reach the PowerLine SpawnSession RPC a malicious or compromised agent acting through the orchestration layer, or an...

@grackle-ai/cli (>=0.82.2, <=0.132.1), @grackle-ai/powerline (>=0.82.2, <=0.132.1) +6 more potentially affected by unknown CVE via @grackle-ai/runtime-sdk (>=0.82.2, <=0.132.1)

@grackle-ai/runtime-sdk NPM version =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-VV65-F55V-XM6G...

GHSA-J6HM-V3X2-QV6J land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

Summary ArchiveUtils.untarInputStream, Path and ArchiveUtils.unzipInputStream, Path in land.oras:oras-java-sdk create symbolic-link entries from an archive without validating the symlink target. A malicious tar or zip shipped as an OCI layer blob can place a symlink under the extraction directory...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to issues due to Java SDK (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Java SDK shipped with product. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows an remote attacker to cause...

PT-2026-55206

Name of the Vulnerable Software and Affected Versions @hey-api/openapi-ts versions prior to 0.97.3 Description An issue exists in the dist/clients/core/params.ts file, which is used as a runtime template in generated SDKs. The buildClientParams function fails to validate unknown keys that start...

CVE-2026-49451

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause proce...

MAL-2026-6635 Malicious code in @orbis-lr-sdk/orbis-lr-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 447ee314f32023031250cefe4570378f31d8055a02384eccecb5c288ae6e2405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @orbis-lr-sdk/orbis-lr-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 447ee314f32023031250cefe4570378f31d8055a02384eccecb5c288ae6e2405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6640 Malicious code in @rakuten-rewards/messaging-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5881076c822a732d6344ff3614bf7437722ca46d9d5f5dbdf3105586fa078dd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2026-531 Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Impact What kind of vulnerability is it? Who is impacted? An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and...

[SECURITY] Fedora 44 Update: dotnet9.0-9.0.118-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 44 Update: dotnet10.0-10.0.109-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Fedora 44 : dotnet10.0 (2026-dec081126f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dec081126f advisory. Update to .NET SDK 10.0.109 and Runtime 10.0.9 Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591 Release Notes: - SDK:...

Fedora 43 : dotnet10.0 (2026-a424c1061e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a424c1061e advisory. Update to .NET SDK 10.0.109 and Runtime 10.0.9 Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591 Release Notes: - SDK:...

Fedora 44 : dotnet8.0 (2026-041785a779)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-041785a779 advisory. Update to .NET SDK 8.0.128 and Runtime 8.0.28 Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591 Release Notes: - SDK:...

Fedora 44 : dotnet9.0 (2026-0dce096c13)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0dce096c13 advisory. Update to .NET SDK 9.0.118 and Runtime 9.0.17 Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591 Release Notes: - SDK:...

Fedora 43 : dotnet8.0 (2026-2f80369c73)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f80369c73 advisory. Update to .NET SDK 8.0.128 and Runtime 8.0.28 Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591 Release Notes: - SDK:...