RockyLinux 9 : kernel (RLSA-2026:49870)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49870 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 Bug Fixes and Enhancements: Possible regression with...

EulerOS 2.0 SP15 : python-ply (EulerOS-SA-2026-2945)

According to the versions of the python-ply packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in th...

CVE-2026-15991: Missing Authorization

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

ROS-20260806-73-0023

The vulnerability of the unpoisonmemory function in the mm/memory-failure.c module of the Linux kernel relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

RockyLinux 10 : kernel (RLSA-2026:49871)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49871 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID whil...

Oracle Linux 9 : kernel (ELSA-2026-49870)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49870 advisory. - timers: Fix NULL function pointer race in timershutdownsync CKI Backport Bot RHEL-189940 CVE-2025-68214 Tenable has extracted the preceding description block...

EulerOS 2.0 SP13 : glibc (EulerOS-SA-2026-2965)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer...

EulerOS 2.0 SP15 : python-ply (EulerOS-SA-2026-2904)

According to the versions of the python-ply packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in th...

EulerOS 2.0 SP15 : libxslt (EulerOS-SA-2026-2897)

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT func:result elements during stylesheet parsing. Due to...

CVE-2026-18970

CVE-2026-18970 affects Rongzhitong Visual Integrated Command and Dispatch Platform (

Missing Authentication for Critical Function

Overview @nuxt/devtools is a Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the nuxt:devtools:rpc. An attacker can execute arbitrary commands on the host system by sending crafted RPC calls to the exposed WebSocket endpoint without...

CVE-2026-18959

A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi/routes/panel-api.php of the component Files Endpoint. This manipulation causes path traversal. The attack may be initiated remotely. The...

CVE-2026-9205 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Malicious code in npm-groat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...

Malicious code in ts-toolkit-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d47be3f5dc16ea70755e0233f46106d3f50d1d5384a4f20c76b91463c9876c The package's main entry defines a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/112...

Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in poly-bbc-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb49d43833628610acae14ea039bb3a490dc94ec90bd8faac084a977a8f8ebd The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...