Oracle Linux 9 : skopeo (ELSA-2026-70641)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70641 advisory. - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862 Tenable has extracted the preceding description block directl...

MAL-2026-16494 Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5676 more potentially affected by CVE-2026-93567 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93567 Source advisory: MEND:CVE-2026-93567...

org.keycloak:keycloak-crypto-elytron (>=26.6.0, <=26.7.5), org.keycloak:keycloak-saml-wildfly-elytron-adapter (>=26.6.0, <=26.7.5) +2 more potentially affected by CVE-2026-10832 via org.wildfly.security:wildfly-elytron (>=2.7.0.cr1, <=2.8.5.final)

org.wildfly.security:wildfly-elytron MAVEN version =2.7.0.cr1, =26.6.0, =26.6.0, =26.6.0, =26.7.5 - org.wildfly:wildfly-webservices-tests-integration 38.0.0.beta1 Source cves: CVE-2026-10832 Source advisory: MEND:CVE-2026-10832...

Malicious Package

Overview linkedin-tests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-54918 NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

CVE-2026-54916

NetBox Device Type Library (a community-sourced collection of device type definitions for import into NetBox) is affected by a module-shadowing vulnerability (CVSS 8.8 HIGH). The absence of tests/__init__.py combined with the lack of --import-mode=importlib causes pytest's prepend import mode to ...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

androidx.benchmark:benchmark-common (>=1.3.0-alpha02, <=1.3.4), androidx.benchmark:benchmark-macro (>=1.3.0-alpha02, <=1.3.4) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.7)

com.squareup.wire:wire-runtime MAVEN version 4.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.3.0-alpha02, =1.3.0-alpha02, =2.5.9.final, =2.5.9.final,...

com.squareup.wire:wire-grpc-client (5.3.4), com.squareup.wire:wire-schema (5.3.4) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.3.4)

com.squareup.wire:wire-runtime MAVEN version 5.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 5.3.4 - com.squareup.wire:wire-schema 5.3.4 -...

com.squareup.wire:wire-grpc-client (4.9.5), com.squareup.wire:wire-schema (4.9.5) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.5)

com.squareup.wire:wire-runtime MAVEN version 4.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.5 - com.squareup.wire:wire-schema 4.9.5 -...

com.squareup.wire:wire-grpc-client (4.9.4), com.squareup.wire:wire-schema (4.9.4) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.4)

com.squareup.wire:wire-runtime MAVEN version 4.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.4 - com.squareup.wire:wire-schema 4.9.4 -...

com.squareup.wire:wire-grpc-client (5.0.0-alpha01), com.squareup.wire:wire-schema (5.0.0-alpha01) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.0.0-alpha01)

com.squareup.wire:wire-runtime MAVEN version 5.0.0-alpha01 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 5.0.0-alpha01 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (5.0.0-alpha02), com.squareup.wire:wire-schema (5.0.0-alpha02) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (5.0.0-alpha02)

com.squareup.wire:wire-runtime MAVEN version 5.0.0-alpha02 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 5.0.0-alpha02 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.9.0), com.squareup.wire:wire-schema (4.9.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.0)

com.squareup.wire:wire-runtime MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.0 - com.squareup.wire:wire-schema 4.9.0 -...

com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha03), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha03) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha03)

com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha03 Source cves: CVE-2026-63126 Source advisory: SNYK:JAVA-COMSQUAREUPWIRE-19964080...

com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha03), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha03) +1 more potentially affected by CVE-2026-45799 +1 more via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha03)

com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha03 Source cves: CVE-2026-45799, CVE-2026-63126 Source advisory: GHSA-9RM7-3QHH-H2MC...