Topic
Security and reliability risks arising from third-party code, libraries, and dependencies that software products incorporate or rely on.
CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
The point release corrects 106 source packages and rebuilds the installer around a 6.12.107+deb13 kernel, so hosts imaged from older trixie media come up on versions predating all 92 advisories and only catch up on the first update run.
Reality
VulnCheck rates CVE-2026-82533 at 9.4. DeepSeek pushed a fix on August 27. The build named in the record never reached npm, and the sandbox itself still confines only writes.
Reality
The founders' claim is that permissions describe an agent's reach while its context decides its behaviour, and their own scan of 142,836 public skills flagged roughly one in eight as leaning on an external resource they could not vouch for.
Reality
DuckLabs keeps its Amsterdam desks and the MIT license still holds. The change is who pays for the roadmap, and what that does to a database compiled into your product.
Reality
Support is live in the InspectorScan API and ECR Basic scanning, according to Red Hat. The registry scanner covers operating system packages, which is most of what a distroless image no longer has.
Reality
SecretSpec's dotenv-ng 1.0 makes dollar signs literal after dotenvy silently dropped parts of a bcrypt hash. The damage surfaced as an authentication failure, far from the parser that caused it.
Reality