277944 matches found
Malicious code in content-publisher-sdks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir,...
RHSA-2026:50281 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2025:7118 Red Hat Security Advisory: osbuild and osbuild-composer security update
Bulletin has no description...
RHSA-2023:0777 Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
Bulletin has no description...
MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...
Session Hijacking
MCP Ruby SDK is vulnerable to Session Hijacking. The vulnerability is due to missing session ownership validation in StreamableHTTPTransport, allowing attackers with a stolen session ID to execute tool calls within the victim's session...
Malicious code in beaver-ui-hooks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...
CVE-2026-68075 Apache Qpid Broker-J: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...
ROOT-OS-DEBIAN-11-CVE-2025-38004 CVE-2025-38004 in linux - Patched by Root
Root has patched CVE-2025-38004 in the linux package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-53077 CVE-2026-53077 in linux - Patched by Root
Root has patched CVE-2026-53077 in the linux package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2024-44934 CVE-2024-44934 in linux - Patched by Root
Root has patched CVE-2024-44934 in the linux package for Root:Debian:11. Multiple fixed versions available...
Photon OS 5.0: Sqlite PHSA-2026-5.0-92-0889
An update of the sqlite package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0889. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Rust PHSA-2023-5.0-91-0067
An update of the rust package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0067. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Linux PHSA-2024-5.0-91-0374
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0374. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...
Malicious code in @servicetitan/microfront-tests (npm)
npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/acquisition-functions (npm)
npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...
MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)
npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...