240511 matches found
Security update for java-1_8_0-ibm
This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator bsc1274275. CVE-2026-16439: using -Xtrace to trace method arguments can lead to buffer...
Security update for dracut
This update for dracut fixes the following issue: Update to version 059+suse.572.g753fdae1b. Securitys issue fixed: CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: Fixbase: sanitize message...
CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
CVE-2026-73647
The vulnerability CVE-2026-73647 affects Quasar Framework prior to version 2.22.0. The public extend() utility in ui/src/utils/extend/extend.js recursively copies attacker-controlled keys during deep merges (extend(true, target, source)) and does not reject an own proto property. This could cause...
CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
EUVD-2026-58189
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
CVE-2026-73567 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
EUVD-2026-58182
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
CVE-2026-73567
Summary: The vulnerability affects the sm-crypto library (SM2/SM3/SM4) prior to version 0.5.0. The default Node.js key generation path for sm2.generateKeyPairHex() relied on a module-wide SecureRandom seeded from Math.random() and Date to an ARC4 stream because window.crypto.getRandomValues was u...
CVE-2026-73567 sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...
CVE-2026-25589
A flaw was found in RedisBloom. An authenticated attacker with permission to execute the RESTORE command on a Redis server with the RedisBloom module loaded can supply a crafted serialized payload that causes an invalid memory access due to an improper validation of serialized values processed...
MAL-2026-13949 Malicious code in external-process-live-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...
Malicious code in external-process-live-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...
Malicious code in @leonardo0902/vortex-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passe...
MAL-2026-13939 Malicious code in @leonardo0902/vortex-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passe...
Malicious code in vexium-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...
MAL-2026-13963 Malicious code in vexium-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...
MAL-2026-13938 Malicious code in @kolbo/mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...
Malicious code in @kolbo/mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...