Security notices
What Pharon has published most recently: compromised packages, exploited vulnerabilities, vendor breaches and end-of-life deadlines. Teams using Pharon are alerted when a notice affects something they run.
Loading notices…
What Pharon has published most recently: compromised packages, exploited vulnerabilities, vendor breaches and end-of-life deadlines. Teams using Pharon are alerted when a notice affects something they run.
Loading notices…
Compromised package, critical
Malicious code in macs-shoaibs-pro17Compromised package, critical
Malicious code in @axon-web/iconsCompromised package, critical
Malicious code in hs-frameworkCompromised package, critical
Malicious code in privacypass-pyCompromised package, critical
Malicious code in pystr-codecVendor incident, critical
Northflank breach exposes customer environment variables; AI API keys abusedCompromised package, critical
Malicious code in @mamans2973/mamanEnd of life, medium
Kubernetes 1.32 reached end of life on 2026-02-28End of life, medium
MySQL 9.5 reached end of life on 2026-01-20Forced upgrade, medium
Amazon EKS Kubernetes 1.32 reached end of standard support on 2026-03-23End of life, medium
PHP 8.1 reached end of life on 2025-12-31End of life, medium
Node.js 25 reached end of life on 2026-06-01Forced upgrade, medium
Amazon EKS Kubernetes 1.33 reached end of standard support on 2026-07-29End of life, medium
PostgreSQL 13 reached end of life on 2025-11-13Forced upgrade, medium
Amazon RDS for PostgreSQL 13 reached end of standard support on 2026-02-28Forced upgrade, low
Amazon EKS Kubernetes 1.34 reaches end of standard support on 2026-12-02End of life, medium
Kubernetes 1.34 reached end of life on 2026-10-27Forced upgrade, low
Amazon RDS for PostgreSQL 14 reaches end of standard support on 2027-02-28End of life, low
Redis 8.0 reaches end of life on 2026-12-01End of life, medium
MySQL 26.7 reached end of life on 2026-10-20End of life, medium
Go 1.25 reached end of life on 2026-08-19End of life, medium
MongoDB 8.2 reached end of life on 2026-07-31End of life, medium
Ruby 3.2 reached end of life on 2026-03-31End of life, low
Kubernetes 1.35 reaches end of life on 2027-02-28Forced upgrade, medium
Amazon RDS for MySQL 8.0 reached end of standard support on 2026-07-31Forced upgrade, medium
Amazon EKS Kubernetes 1.31 reached end of standard support on 2025-11-26End of life, medium
MySQL 9.6 reached end of life on 2026-04-21End of life, medium
MySQL 8.0 reached end of life on 2026-04-30End of life, medium
Kubernetes 1.31 reached end of life on 2025-11-11End of life, medium
Python 3.10 reached end of life on 2026-10-01End of life, medium
Kubernetes 1.33 reached end of life on 2026-06-28End of life, medium
Go 1.24 reached end of life on 2026-02-10End of life, low
PostgreSQL 14 reaches end of life on 2026-11-12End of life, medium
Node.js 20 reached end of life on 2026-04-30End of life, low
PHP 8.2 reaches end of life on 2026-12-31Compromised package, critical
Malicious code in doctreelstmCompromised package, critical
Malicious code in multi-convertCompromised package, critical
Malicious code in md-to-slidesCompromised package, critical
Malicious code in skills-analyzerVendor incident, medium
Chainalysis breached via "offensive agentic techniques"; customer names and emails accessedCompromised package, critical
Malicious code in is-it-aiCompromised package, critical
Malicious code in local-commander-agentPackage vulnerability, high
github.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryPackage vulnerability, high
github.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsPackage vulnerability, high
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchPackage vulnerability, high
pypdf has possible large memory usage when parsing page treePackage vulnerability, high
pypdf has possible infinite loop when cloning dictionariesPackage vulnerability, high
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicePackage vulnerability, high
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicePackage vulnerability, high
Authlib RFC 7592 examples omit registration-access-token client bindingPackage vulnerability, high
pypdf has possible long runtimes when retrieving page labelsPackage vulnerability, high
pypdf has possible large memory usage for exceptions in strict modePackage vulnerability, high
pypdf has possible long runtimes/large memory usage for encrypted PDF filesPackage vulnerability, high
pypdf has possible large memory usage when parsing cross-reference streamsPackage vulnerability, high
pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingPackage vulnerability, high
pyasn1 has quadratic-complexity denial of service in binary REAL decodingPackage vulnerability, high
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingPackage vulnerability, high
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingPackage vulnerability, high
node-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)Package vulnerability, high
node-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countPackage vulnerability, high
node-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messagePackage vulnerability, high
node-forge: Forge: Denial of service in TLS record processing via call stack exhaustionPackage vulnerability, high
node-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13Package vulnerability, high
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload LocationPackage vulnerability, high
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsPackage vulnerability, high
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationPackage vulnerability, high
GraphQL-core has denial of service via memory leak in aborted validationsPackage vulnerability, high
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientPackage vulnerability, critical
signalk-server, @signalk/resources-provider: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionPackage vulnerability, critical
github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2 and 1 more: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service…Package vulnerability, high
github.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker c…Package vulnerability, high
github.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size…Package vulnerability, high
adminneo-org/adminneo: AdminNeo SQLite Database-List Drop Arbitrary File DeletionPackage vulnerability, high
adminneo-org/adminneo: AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersPackage vulnerability, high
adminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)Package vulnerability, high
adminneo-org/adminneo: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)Package vulnerability, critical
pypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIPackage vulnerability, high
adminneo-org/adminneo: AdminNeo: version-cache array injection causes persistent denial of servicePackage vulnerability, high
Amazon Kinesis Producer Library for Java leaks AWS credentials in debug logs and process arguments (CVE-2026-119117)Compromised package, critical
Malicious code in vas-tops2-reportinguiCompromised package, critical
Malicious code in @sxm-content-creators/tools-dsCompromised package, critical
Malicious code in vas-tops2-digital-assistant-uiCompromised package, critical
Malicious code in @pcb-dp/qa-commonsCompromised package, critical
Malicious code in vas-tops2-core-client-cleanup-uiCompromised package, critical
Malicious code in vas-tops2-core-clients-searchCompromised package, critical
Malicious code in @tops2/digital-assistant-uiCompromised package, critical
Malicious code in vas-tops2-core-property-searchCompromised package, critical
Malicious code in vas-tops2-bidmatrix-uiCompromised package, critical
Malicious code in ssite-mock-serverCompromised package, critical
Malicious code in tefeest-npm-com-testCompromised package, critical
Malicious code in dependencykfegCompromised package, critical
Malicious code in neuralwhatsappCompromised package, critical
Malicious code in apex-fetchCompromised package, critical
Malicious code in ourin-baileysCompromised package, critical
Malicious code in grizzly-baileysCompromised package, critical
Malicious code in tabby-fknatPackage vulnerability, high
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPackage vulnerability, high
@nx/maven and @nx/gradle have OS command injection via nx.json plugin optionsCompromised package, critical
Malicious code in @nexlayerlabs/postcss-keyframe-utilsPackage vulnerability, high
`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)