com.github.pires:hazelcast-kubernetes-bootstrapper (3.8.6), com.hazelcast:hazelcast-build-utils (3.8.6) +26 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.8.6)

com.hazelcast:hazelcast MAVEN version 3.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.github.pires:hazelcast-kubernetes-bootstrapper 3.8.6 - com.hazelcast:hazelcast-build-utils 3.8.6 -...

RHLW-2026-CD27691C140AA026 Lightwell Security Advisory: plexus-utils 4.0.1.rhlw-00001

Red Hat Lightwell has released org.codehaus.plexus:plexus-utils 4.0.1.rhlw-00001 with a backported security fix. CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This...

Malware in dom-utils-lite

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @praveenvjpm/color-utils-7210 (npm)

Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag files from /flag, /flag.txt, /app/flag, /home/node/flag, a...

Malicious Package

Overview dom-utils-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @praveenvjpm/color-utils-7210 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

MAL-2026-17651 Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

EulerOS 2.0 SP15 : cifs-utils (EulerOS-SA-2026-3901)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

EulerOS 2.0 SP15 : cifs-utils (EulerOS-SA-2026-3967)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

[SECURITY] [DSA 6549-1] xz-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6549-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 07, 2026 https://www.debian.org/security/faq -...

flux:rabbitmq-action (>=1.0.0, <=1.0.1), flux:rabbitmq-trigger (>=1.0.0, <=1.0.1) +11 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (2.2.0)

com.rabbitmq:amqp-client MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - flux:rabbitmq-action =1.0.0, =1.0.0, =1.0.3, =0.14.0, =5.5.0, =5.5.0, =5.5.0, =5.5.0, =5.7.1, =5.7.1, =5.7.1,...

com.jasonclawson:rabbitmq-ha-client (>=0.5.0, <=0.5.2), com.m3958.vertxprj:applogvertx (0.0.1) +4 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.1.4)

com.rabbitmq:amqp-client MAVEN version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.jasonclawson:rabbitmq-ha-client =0.5.0, =0.3.0, =0.0.2, =0.0.4 Source cves: CVE-2026-106121 Source advisory...

EUVD-2026-92803

Docling has SSRF guard bypass in remote resource fetching DNS rebinding / multi-record resolution; no IP validation in HTML render mode...

3nit-utils (>=0.30.0, <=1.0.2), 4chan-boards (>=1.0.0, <=2.0.1) +3805 more potentially affected by CVE-2026-107353 via traverse (>=0.6.0, <=0.6.11)

traverse NPM version =0.6.0, =0.30.0, =1.0.0, =0.0.0-canary.0, =0.0.1, =1.25.0, =2.0.0, =0.0.1, =4.2.1, =1.0.0, =0.0.2, =2.1.0, =2.10.5 and more Source cves: CVE-2026-107353 Source advisory: MEND:CVE-2026-107353...

ai-parrot (>=0.5.0, <=0.5.16), aleksis-app-order (>=0.1.1, <=0.7.0.dev0) +11 more potentially affected by CVE-2026-106443 via weasyprint (61.2.0)

weasyprint PYPI version 61.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.5.0, =0.1.1, =1.0.0, =0.1.1, =3.3.0, =0.9.8, =21.9.1, =1.0.1, =3.12.27, =2.8.0, =2.10.1 - xblock-ai-eval 0.3.3 Source cves:...

com.qaprosoft:carina-api (>=6.0.4, <=6.1.24), com.qaprosoft:carina-aws-s3 (>=6.0.4, <=6.1.24) +6 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.9.0)

com.rabbitmq:amqp-client MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.qaprosoft:carina-api =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =3.3.48, =4.0.58 -...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the authentication lifecycle in wger/core/views/user.py and the API token management in wger/utils/apitoken.py, where bearer-style API credentials are not revoked on logout or password change. The...

Debian dsa-6549 : liblzma-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6549 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6549-1 [email protected] https://www.debian.org/security/...

SUSE CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...