Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...

New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative ZDI detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02...

Important: clamav1.5

Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...

Important: clamav1.4

Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1955)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1955 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Oracle Linux 9 : php:8.2 (ELSA-2026-40416)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory. php 8.2.32-1 - rebase to 8.2.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 -...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

[SECURITY] Fedora 44 Update: rust-astral_async_zip-0.0.20-1.fc44

An asynchronous ZIP archive reading/writing crate...

[SECURITY] Fedora 43 Update: rust-astral_async_zip-0.0.20-1.fc43

An asynchronous ZIP archive reading/writing crate...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview mpxj is a Python wrapper for the MPXJ Java library for manipulating project files Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system...

Directory Traversal

Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to...

Fedora 44 : python-uv-build / rust-astral_async_zip / uv (2026-be84487fdd)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-be84487fdd advisory. Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials. Tenable has extracted the preceding...

Fedora 43 : python-uv-build / rust-astral_async_zip / uv (2026-8893ec1aeb)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-8893ec1aeb advisory. Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials. Tenable has extracted the preceding...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...

Linux Distros Unpatched Vulnerability : CVE-2026-14266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Directory Traversal

Overview proot-distro is a PRoot-Distro is a lightweight rootless Linux container management utility built around proot. Affected versions of this package are vulnerable to Directory Traversal via the copy command. An attacker can read or overwrite files outside the intended container root...