Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

MAL-2026-12353 Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in remote_session_elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69 Package version 9999.0.0 is published with placeholder metadata "Shared utility helpers.", no author — the canonical shape of a dependency-confusion...

CLSA-2026-1785934478 TuxCare security update for certifi (1 CVE)

TuxCare rebuilt certifi to address 1 CVE. Fixed in 2023.7.22.post2+tuxcare...

WordPress VikRentItems Flexible Rental Management System plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin VikRentItems Flexible Rental Management System versions = 1.2.1...

MAL-2026-12405 Malicious code in opencode-engos-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...

Astra Linux – Vulnerability in Firefox

JIT compilation errors in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3...

Astra Linux – Vulnerability in Firefox

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Astra Linux – Vulnerability in Firefox

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11...

Astra Linux – Vulnerability in Firefox

A memory safety bug has been fixed in Firefox 152. This vulnerability was addressed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 150.0.1. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 150.0.2 and Thunderbird 150.0.2...

Astra Linux – Vulnerability in Firefox

Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox...

MAL-2026-12320 Malicious code in @lizhao1/memorax-code-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285 The npm postinstall script bin/memorax-code-plugin-postinstall.mjs unconditionally calls enableInternalDataCollectionConfig with no user prompt,...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

WordPress Seraphinite Accelerator plugin <= 2.29.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Alireza in WordPress Plugin Seraphinite Accelerator versions = 2.29.18...

WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update vulnerability

Unauthenticated Trip Difficulty Level Option Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Travel Engine versions 6.8.2...

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by XBumbbleB33 in WordPress Plugin PublishPress Capabilities versions = 2.45.0...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...