The npm package 'translate-base-font' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'ui.dist.min.js' contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by the package.
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.
CVE-2026-104988 is a high-severity authentication bypass vulnerability in Red Hat Certificate System 10's Dogtag PKI component. The flaw occurs in the CMCAuthForEST authentication plugin, which incorrectly allows an EST fullcmc enrollment request via BasicAuth without a TLS client certificate to be treated as agent-privileged. This enables an authenticated EST user to obtain CA-signed certificates with arbitrary subject names, potentially compromising certificate issuance integrity.
CVE-2026-12392 is an information exposure vulnerability in Canonical MAAS that allows unauthenticated attackers to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. This affects versions prior to 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0. The vulnerability requires that the target machine was deployed with the 'register as rack' option enabled and that the attacker can obtain or infer the machine's system ID to exploit the flaw.
Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana12.4 package to address multiple security vulnerabilities identified by CVE identifiers including CVE-2026-101903 and CVE-2026-93450. The advisory provides updated RPM packages for the aarch64 and x86_64 architectures. No explicit affected versions are detailed in the advisory. The update is classified as a security fix and is available via Red Hat's official channels.
This update for pcapplusplus fixes the following issues:
Changes in pcapplusplus:
- Update to version 26.07
* libpcap / WinPcap / Npcap is now optional.
* Bumped the minimum required C++ standard to C++14
Protocol support:
* Added Modbus protocol
* Added DoIP - Diagnostic over Internet Protocol
* Added PostgreSQL Wire Protocol (PGWire), including
additional message types
* Added MySQL Wire Protocol
* Discrete FTPControl and FTPData protocol types
* Add support for AccurateECN TCP flag
* Improve SIP packet detection using heuristic parsing
* Recognize LLC payload in SLL2
Added extensive X.509 / cryptography support:
* X.509 certificate decoding, extension parsing, and parsing
of X.509 certificates embedded in SSL/TLS messages
* Export/import of X.509 certificates to PEM format, plus a
new general-purpose PEM codec
* Cryptographic key decoders (RSA/EC private and public keys)
* Base64 encoding/decoding
* A new X509Toolkit example application
* Expanded ASN.1 codec support: BitString,
UTCTime/GeneralizedTime, ObjectIdentifier and string records,
plus arbitrary-size integer support
* IFileReaderDevice::createReader() and
IFileReaderDevice::tryCreateReader() use file-content
heuristics
to automatically pick the right reader (pcap/pcapng/snoop)
instead of relying solely on the file extension
* Add incremental packet parsing support with
Packet::parsePacket()
* Added multi-language README support: Japanese
* IPv4Address/IPv6Address/MacAddress user-defined literals,
e.g. constructing addresses directly from string literals,
and sized buffer-construction overloads
* Explicit-ownership overloads for RawPacket::setRawData(),
and a sized overload for Layer::copyData()
* Improved zstd support: added a build flag to control zstd
support
* A new SuppressLogs RAII class for temporarily suppressing
log output
* Large-scale internal refactoring of the device layer
(PcapLiveDevice, DpdkDeviceList, file readers/writers,
statistics tracking), the logging infrastructure, and the
packet parsing infrastructure, improving encapsulation,
thread-safety, and maintainability
* Improved benchmarking: added a pure-parsing benchmark and
extended benchmarks to support PcapNG and Snoop files
* Test refactoring: replace packet creation macros in with C++
functions
* Tons of security and correctness bug fixes
Breaking changes:
* The minimum required C++ standard has been raised to C++14
* IPcapDevice has been removed; its logic now lives in
PcapLiveDevice
* libpcap/WinPcap/Npcap is now an optional dependency -
building without it disables Pcap++ capture features, though
Common++/Packet++ (including pcap file I/O) remain fully
usable
* Various internal APIs around device lists and statistics
tracking were reworked as part of the refactoring above; this
may affect code relying on undocumented internals
Deprecation list:
* IPv6Address::copyTo() has been deprecated, please use
IPv6Address::copyToNewBuffer() instead
* MacAddress::copyTo() has been deprecated, please use
MacAddress::copyToNewBuffer() instead
* Asn1IntegerRecord::getValue() has been deprecated, please
use Asn1IntegerRecord::getIntValue() instead
* RawPacket::getObjectType() has been deprecated due to
unclear semantics
* RawPacket::setRawData() has been deprecated, please use the
overload that takes takeOwnership parameter for explicit
control
* RawPacket::initWithRawData() has been deprecated, please use
RawPacket::setRawData() with takeOwnership=false instead
* SSLExtension::SSLExtension() has been deprecated, please use
the constructor with bounded span instead
* Several TcpOptionBuilder constructors have been deprecated,
please use the new constructors with TcpOptionEnumType
instead
* TcpLayer::getTcpOption(TcpOptionType option) has been
deprecated, please use the overload
TcpLayer::getTcpOption(TcpOptionEnumType option) instead
* TcpLayer::removeTcpOption(TcpOptionType optionType) has been
deprecated, please use the overload
TcpLayer::removeTcpOption(TcpOptionEnumType optionType)
instead
* MBufRawPacket::getObjectType() has been deprecated due to
unclear semantics
* IFileReaderDevice::getReader() has been deprecated, please
use IFileReaderDevice::tryCreateReader() instead
* PcapFileReaderDevice::isNanoSecondPrecisionSupported() has
been deprecated, nanosecond precision is now natively
supported
by the internal parser and always returns true
* PcapFileWriterDevice::isNanoSecondPrecisionSupported() has
been deprecated, nanosecond precision is now natively
supported
by the internal parser and always returns true
* BpfFilterWrapper::matchPacketWithFilter() has been
deprecated, please use BpfFilterWrapper::matches() instead
* GeneralFilter::matchPacketWithFilter() has been
A security update for wget addresses CVE-2026-16599, which involves a server-controlled unbounded MD5 loop in the FTP OPIE implementation. This vulnerability could potentially cause issues related to resource exhaustion or denial of service. The update fixes this issue in specific SUSE wget package versions.
This update for jline3 fixes the following issue:
Update to upstream version 3.30.17:
* Security Fixes
+ Native Stack Buffer Overflow in Public INPUT_RECORD.memmove
JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6)
+ Authenticated SSH Shell Channel Resource Leak via Null or
Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj)
+ Authenticated SSH DoS via Unbounded Window-Change Terminal
Geometry (GHSA-m935-wqpj-pvp3)
+ TCP Socket File Descriptor Leak When Maximum Connections
Reached (GHSA-c87g-867h-cqr6)
* Bug Fixes
+ strip control characters from file names in posix builtins
+ bound !# history expansion to prevent exponential blowup
+ verify server host keys in the ssh client builtin
+ address remaining security vulnerabilities reported by
AFINE/CERT.PL
+ backport security fixes from master
+ backport security fixes to 3.x (path traversal + DSR plain
text)
+ strip control characters from ssh banner and prompts
* Dependency updates
+ bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to
3.10.2
+ bump slf4j.version from 2.0.18 to 2.0.19
+ bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6
to 3.6.0
+ bump org.apache.maven.plugins:maven-compiler-plugin from
3.15.0 to 3.16.0
+ bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.2
+ bump actions/setup-java from 5 to 6.0.0
+ bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.3.4.1
+ bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.2
+ bump org.easymock:easymock from 5.6.0 to 5.7.0
+ bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2
+ bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to
3.3.4
+ bump org.apache.maven:apache-maven from 4.0.0-rc-3 to
4.0.0-rc-6
+ bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to
0.9.10
+ bump com.palantir.javaformat:palantir-java-format from 2.96.0
to 2.97.0
+ bump release-drafter/release-drafter from 7.6.0 to 7.7.0
+ bump groovy.version from 4.0.32 to 4.0.33
+ bump release-drafter/release-drafter from 7 to 7.6.0
+ bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to
3.5.1
- Update to upstream version 3.30.16
* bugfix release with security hardening, SSH agent forwarding
fix, and terminal compatibility improvements.
* Breaking Changes
+ SSH agent forwarding is no longer enabled by default;
pass -A to explicitly request it
+ reject overlong hex components in OSC color responses
+ strip OSC and other escape sequences in ansiAppend
+ search multiple lib paths for versioned libutil.so
+ use Path.resolve instead of URI.resolve in cat and sort to
prevent SSRF
+ check closed flag in PtyInputStream to prevent hang on empty
input
+ confine ConfigurationPath lookups to the config directory
+ disable Read File command in nano restricted mode
+ drain buffered data before EOF in NonBlockingPumpInputStream
+ look up openpty in libc.so.6 for glibc 2.34+
+ guard styleMatches and highlighter rules against ReDoS
+ backport telnet DoS mitigations (GHSA-47qp, GHSA-2r2c)
+ propagate EOF in PtyInputStream to avoid infinite loop
+ bump org.apache.ivy:ivy from 2.5.3 to 2.6.0
+ bump actions/setup-node from 6 to 7
+ bump com.palantir.javaformat:palantir-java-format from 2.94.0
to 2.96.0
+ bump sshd.version from 2.18.0 to 2.19.0
+ bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to
5.1.0
+ bump org.graalvm.sdk:graal-sdk from 25.0.3 to 25.1.3
+ bump com.diffplug.spotless:spotless-maven-plugin
A vulnerability in pypdf2 prior to version 6.18.1 allows an attacker to craft a PDF with unusually large source-code or destination-string tokens in a font /ToUnicode mapping. This can cause excessive memory consumption during PDF parsing, particularly when extracting text. The issue has been fixed in pypdf version 6.18.1.
A vulnerability in pypdf2 prior to version 6.18.1 allows an attacker to craft a PDF with a TrueType or Type1 simple font containing an unusually large /Widths array. This can cause excessive memory consumption during parsing, such as when extracting text.
A vulnerability in pypdf2 prior to version 6.18.1 allows an attacker to craft a PDF with a partially malformed /FlateDecode stream containing padded data, causing inefficient byte-by-byte decompression and resulting in long runtimes. This issue has been fixed in pypdf version 6.18.1.
A vulnerability in pypdf2 prior to version 6.19.0 allows an attacker to craft a PDF with form field values that causes the appearance stream generation process to repeat invariantly, leading to long runtimes. This occurs when updating form field values with flattening enabled. The issue has been fixed in pypdf version 6.19.0.
A vulnerability in pypdf2 prior to version 6.19.0 allows an attacker to craft a PDF with many embedded files that causes the dictionary-based attachments API to reparse excessively, leading to long runtimes. This issue affects multiple specific versions of pypdf2 and has been assigned CVE-2026-102999. The vulnerability has a CVSS score of 7.5, indicating a medium severity impact focused on availability. A fix is available in pypdf version 6.19.0.
A vulnerability in pypdf2 prior to version 6.19.0 allows an attacker to craft a PDF with unusually large alphabetical page-label values. This causes excessive memory consumption when the page labels are accessed. The issue has been fixed in pypdf version 6.19.0.
A vulnerability in pypdf2 prior to version 6.17.0 allows an attacker to craft a PDF with unusually large Roman numeral page labels, causing excessive memory consumption when the page labels are accessed. This issue has been fixed in pypdf version 6.17.0. Users unable to upgrade immediately can apply the changes from pull request #4047 as a workaround.