GHSA-7QC3-XQXJ-426P vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

CVE-2026-75143 vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

CVE-2026-75144 vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

GHSA-MG5R-49W7-J3CV vulnerabilities

Vulnerabilities for packages: torchaudio-ffmpeg-tarballs...

CVE-2026-75147 vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

CVE-2026-75142 vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

CVE-2026-75146 vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

GHSA-63QJ-83CJ-JP3M vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

GHSA-5VJ8-JGQJ-77H6 vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

GHSA-564V-JR2Q-MGWF vulnerabilities

Vulnerabilities for packages: ffmpeg, torchaudio-ffmpeg-tarballs, eco-python-ffmpeg-minimal...

podman -- vulnerabilities

The Podman developers report: This release addresses CVE-2025-11395, where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host. This release also addresses...

PT-2026-65798

Name of the Vulnerable Software and Affected Versions Gleam versions 0.18.0 through 1.17.x Description Insufficient verification of data authenticity allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. While Gleam fetches package metadata from...

MAL-2026-6570 Malicious code in pkg-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c Package advertises itself as a small string-manipulation library trim, case, pad, wrap but its install-time behavior is a dropper. package.json...

EUVD-2026-39497

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...

GHSA-HG3W-7F8C-63HP pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...

Cargo crates in third party registries can override the cached source of other crates

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. This vulnerability is tracked as CVE-2026-5223. The...

MAL-2026-5914 Malicious code in nottuff15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea629a411d1555cb4dbc80aa218539333aefce15e110ad0a5eaa16e4a58ab5f3 nottuff15 is one entry in a coordinated npm namespace-spam campaign. The tarball ships auto-publish.sh, a bash script that copies the package content...

MAL-2026-5134 Malicious code in @redhat-cloud-services/config-manager-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2026-5142 Malicious code in @redhat-cloud-services/insights-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2026-5147 Malicious code in @redhat-cloud-services/tsc-transform-imports (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...