openSUSE 16 Security Update : podman (openSUSE-SU-2026:21244-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21244-1 advisory. This update for podman fixes the following issues - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE inp...

Fedora 44 : opkssh (2026-a7570524a7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7570524a7 advisory. Update to opkssh 0.15.0. This release fixes several CVEs in bundled/vendored dependencies: - CVE-2026-39829: golang.org/x/crypto/ssh: Denial of...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RHEL 9 : podman (RHSA-2026:37123)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37123 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

MAL-2026-11117 Malicious code in @wagni_bot/web3 (npm)

The npm package @wagnibot/web3 is a supply-chain credential stealer disguised as a web3.js SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-10024 Malicious code in @wagni_bot/eth-agent (npm)

The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-10023 Malicious code in @wagni_bot/bsc-sdk (npm)

The npm package @wagnibot/bsc-sdk is a supply-chain credential stealer disguised as a BNB Smart Chain BSC SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycl...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the readFileFromDisk function in tool-file-uploads.ts. An attacker can exfiltrate sensitive local files by prompt-injecting tool arguments that point the upload path at credential files such as...

MAL-2026-7023 Malicious code in dbzy-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls...

DEBIAN-CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

DEBIAN-CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

AZL-92126 CVE-2026-15171 affecting package wireshark 4.4.7-2

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

DEBIAN-CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

UBUNTU-CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15171 NULL Pointer Dereference in Wireshark

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15171

SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...

CVE-2026-15171

Wireshark contains a vulnerability in its SSH protocol dissector leading to a crash (denial of service). Affected versions are Wireshark 4.6.0–4.6.6 and 4.4.0–4.4.16. The issue is described as a NULL Pointer Dereference (root cause) per CVE records. The public documents do not specify a fixed pat...