buildah security update

1.43.1-3.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-3 - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835 - Resolves: RHEL-188733 RHEL-190066...

podman security, bug fix, and enhancement update

5.8.2-4.0.1 - Rework CNI/Netavark detection logic JIRA: EVG-3769 - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.8.2-4 - bump to upstream commit a476c2b2 fixing CVE-2026-39835 CVE-2026-3982...

@n8n/backend-test-utils (1.28.0), @n8n/db (1.28.0) +1 more potentially affected by CVE-2026-59209 via n8n-core (2.28.0)

n8n-core NPM version 2.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 1.28.0 - @n8n/db 1.28.0 - @n8n/task-runner 2.28.0 Source cves: CVE-2026-59209 Source advisory: SNYK:JS-N8NCORE-17954281...

Denial of Service in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a denial of service memory consumption issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case...

Denial of Service in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a denial of service CPU consumption issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case...

Out-of-bounds Read in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the...

Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmtbmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy...

io.micronaut:micronaut-function-client (2.0.1), io.micronaut:micronaut-test-suite-kotlin (2.0.1) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.1)

io.micronaut:micronaut-http-client MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-function-client 2.0.1 - io.micronaut:micronaut-test-suite-kotlin 2.0...

CVE-2026-59819

A flaw was found in LiteLLM, a proxy server for Large Language Model LLM APIs. A privileged caller, such as a proxy administrator, with permissions to test model connections, could exploit the /health/testconnection endpoint. By supplying specific environment or OIDC OpenID Connect file reference...

Oracle Linux 9 : python3.14-pip (ELSA-2026-36315)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36315 advisory. 25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion +...

CVE-2026-58191 Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

CVE-2026-58191

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

CVE-2026-58191 Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

CVE-2026-59819

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.10-stable, LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams, allowing a proxy administrator or another privileged caller with...

CVE-2026-59819

LiteLLM (proxy for LLM APIs) prior to 1.83.10-stable has a local file read risk via the /health/test_connection endpoint. A privileged caller (e.g., proxy administrator) could supply environment/oidc/file references in litellm_params to read arbitrary local files, exposing sensitive contents. The...

CVE-2026-59819 LiteLLM: Local file read via request-supplied OIDC file references

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.10-stable, LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams, allowing a proxy administrator or another privileged caller with...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the evaluations test run creation endpoint POST /workflows/workflowId/test-runs/new, which authorizes against the workflow:read scope instead of workflow:execute. A user...

Malicious code in rony-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873cd33646b64f2073cc37ed9649a3757fb8aa186d50f700cb8ad199196fd56c The package's main entry index.js collects installer identity data — os.userInfo.username, process.env.INITCWD || process.cwd, and os.hostname — and...

MAL-2026-7001 Malicious code in rony-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873cd33646b64f2073cc37ed9649a3757fb8aa186d50f700cb8ad199196fd56c The package's main entry index.js collects installer identity data — os.userInfo.username, process.env.INITCWD || process.cwd, and os.hostname — and...

MAL-2026-6989 Malicious code in ag-charts-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c50b5a47dde18daf83760926662df3b9890de074cc00938de04892ac79a4d9 [email protected] is a hollow package empty index.js, no scripts, no documented functionality whose sole effect on installers is resolving its...