The npm package 'dowload_ebok_armageddon_by_max_hastings_kv3s4' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, uncompromised device is strongly advised. However, removal of the package alone may not fully eliminate the malicious presence due to potential persistence mechanisms.
Red Hat has issued a security update for the java-21-openjdk packages included in Red Hat Enterprise Linux 10. This update addresses multiple security vulnerabilities in the OpenJDK 21 Java Runtime Environment and Software Development Kit, including issues related to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, and various other components. The update is rated as having an Important security impact. Users should apply this update to mitigate these vulnerabilities.
A vulnerability in graphql-core versions from 3.3.0a3 up to but not including 3.3.1 allows unauthenticated clients to cause uncontrolled memory growth by repeatedly submitting documents with more than 100 validation errors. This occurs because the validate() function reuses a module-level exception, causing tracebacks to accumulate and retain memory indefinitely. The issue is fixed in version 3.3.1.
Red Hat Satellite 6.17 has received a security update addressing multiple vulnerabilities across various components including openvox-agent, openvox-server, puppet-agent, puppetserver, satellite/iop-vmaas-rhel9, and yggdrasil-worker-forwarder. The issues include cookie injection, heap buffer overflow, invalid pointer dereference, denial of service via multiple vectors, access control bypass, HTTP request smuggling, and man-in-the-middle attacks. These vulnerabilities affect components such as curl, Bouncy Castle for Java, Eclipse Jetty, jackson-core, jackson-databind, golang libraries, and gRPC-Go. The update is rated as important by Red Hat Product Security and fixes are available for these issues.
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.
A vulnerability in the Fiber web framework versions 2.52.1 and 2.52.2 affects the CORS middleware's domain validation. The validateDomain wildcard matcher improperly strips the scheme and only checks for a host suffix without requiring a dot boundary. This allows an attacker-controlled origin with a host ending in the configured base domain to bypass restrictions when wildcard-subdomain AllowOrigins and AllowCredentials are enabled, potentially exposing authenticated cross-origin responses to the attacker. The issue is fixed in version 2.52.3.
A security update for the cjose component addresses a vulnerability identified as CVE-2026-53938. This update is functionally equivalent to the Red Hat advisory RHSA-2026:90812. No specific technical details or affected versions are provided in the input data.
Two denial of service vulnerabilities were identified in Grafana, an open source metrics dashboard and graph editor. The first vulnerability (CVE-2026-8609) involves unbounded memory growth in the OAuth login route. The second (CVE-2026-33382) involves excessive memory allocation from large API request payloads. These issues could cause Grafana to consume excessive memory, potentially leading to service disruption. Red Hat has issued a security update for Grafana in Red Hat Enterprise Linux 9 to address these vulnerabilities.
A resource exhaustion vulnerability exists in the joserfc Python library prior to version 1.7.6. The vulnerability occurs during compact JWS deserialization, where attacker-controlled input causes excessive memory allocation before size limits are enforced. This can lead to denial of service by exhausting process memory, even if signature verification ultimately fails. The issue is resolved in version 1.7.6.
A heap overflow vulnerability in the X.Org X11 libXrender runtime library's RenderQueryPictFormats function allows for code injection. This security flaw is tracked as CVE-2026-88807 and affects Red Hat Enterprise Linux 9 across multiple architectures. Red Hat has issued an important security update to address this issue.
Bricks Theme version 2.4 and earlier for WordPress has an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. This flaw allows anonymous attackers to read draft and unpublished page content by manipulating the popupId parameter without any status or capability checks. Attackers can use a public nonce obtained via the bricks_regenerate_query_nonce action to enumerate confidential unpublished posts on the site.
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery (SSRF) vulnerability in the Vault credential store integration. An authenticated user with permissions to manage credential stores and credential libraries within a project can exploit this flaw to make the Boundary controller send outbound requests to arbitrary network destinations and receive the responses. This could expose internal endpoints accessible only from the controller's host, such as cloud instance metadata services. The vulnerability is identified as CVE-2026-13303 and has a high severity rating. It is fixed in Boundary Enterprise versions 1.0.2 and 0.21.6.
A vulnerability in openshift-ansible's installer container run script allows downloading and executing remote inventory and dynamic scripts without verifying their integrity. An attacker with network-level access or control over the remote script server could substitute malicious executables, which would run with the installer's user ID and full cluster provisioning privileges, enabling arbitrary code execution. The risk is limited to environments that use remote inventory sources via environment variables and is mitigated by securing network communications and using HTTPS with trusted servers.
IDrive Backup for Windows versions 7.0.1.1 and earlier contain a vulnerability in the id_service.exe component that allows a local attacker to execute arbitrary code. This issue is resolved in version 7.0.1.2.
A vulnerability in IDrive Backup for Windows versions 7.0.1.1 and earlier allows a local attacker to execute arbitrary code via the id_service.exe component. This issue is fixed in version 7.0.1.2.
A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk version 9.6.1. This vulnerability is triggered by processing a specially crafted USGS DEM file, which can cause a buffer overflow. An attacker can exploit this by providing a malicious file to the vulnerable functionality, potentially leading to denial of service due to application crash.
An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a high-severity impact including denial of service. The vulnerability is identified as CVE-2026-9535 with a CVSS score of 8.2.
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This vulnerability can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition. The flaw does not impact confidentiality or integrity but can cause a denial of service due to application crash or instability.