---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2437e1fd9ae50847d65ad13143feee6a95db0cab757957d69e9042c455ba6dc6)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (9194aa79e0fc94d05dae7bedc543d386a31b57d15f9f4c9c0de72e94815e916c)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (7289e08e37e78bdaf8ea1094ca343e14258f7ba298c77c5b44441b70959effe5)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (378b93e2fdcc6d136c5084e67c23b7b0064a6d3c60c9b930139bcabbd7fda01f)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (42351e344c98116a5cb7199775ff056c15ef0bfc9438ab2bb5572537ee6c6668)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (305b264f18fb6c6fbe44527e025daa1edbb1a8b924872d972d0e3ed52988df30)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (d2e2208d1f94f827dbd8df3a4caea909f2a48c578210a65994b154c406d69309)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (4f51a17b4ca7ee290d2e9a0b350c2ea127e2928163ed9424151a81c2b031a1bd)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (6730b24c3c05d3932115bd913aa61bc47492a46c40ce446bcae9baae2e3f6e84)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (063fe0b898385ef92c183ae6524d94ab1a1b6c5671a45ae4be5d57b8f8a6db6a)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (54a52f538886a14c75c249f7bb24617b2a7553f143ccddefb5b08fd36fa45ef3)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (2e60cc3ba68190d1a9f72bb1f4e3f72ce5a9dba0546cf04438409c3d7a5bb04b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (dc97c0e25263f1e0bf6e650d8cf2472a2b1d91bd48d6b87fef69851d8ec7a94d)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (5e4f16d6d4ad1b81c7a387a64220b42f9d497ef1082d5d12e2616d460178cc27)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (bf38b5c988cb0adfeadc6982e4aad7104607ab40c7bc0512e9dbc3eb1fdf8453)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (7bc429794387e66d437c6d5764d357aefc7485377cc9a3ef49909dfe7daa78e9)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (34c39cc6f2efa3cedf4b416adb1d372b92b7eb4649e849396b2948e99db33317)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-128124 is a high-severity vulnerability in aiohttp versions prior to 3.14.4. The issue arises from inefficient regular expression handling in Application.add_domain(), where multiple asterisk wildcards in domain masks lead to polynomial-time processing of certain Host headers. This can allow a remote attacker to stall the event loop by sending crafted headers, causing a denial of service. The vulnerability is fixed in aiohttp version 3.14.4.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (02f165bcdace711ebc167bf743cc4687993dc74464de254a8d4a61f5ded376ba)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.