122543 matches found
ALSA-2026:58572 Moderate: NetworkManager security update
NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband WWAN, and PPPoE devices, as well as providing VPN integration with a varie...
PT-2026-80856
Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...
PT-2026-80892
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...
PT-2026-80795
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...
RHEL 8 : NetworkManager (RHSA-2026:58555)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58555 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...
PT-2026-80879
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders...
CVE-2026-5388
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
CVE-2026-5388
justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...
CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
EUVD-2026-64652
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
CVE-2026-5388
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...
CVE-2026-77116
The Brave Popup Builder WordPress plugin (slug: brave-popup-builder ) is vulnerable to a broken access control issue in versions through 0.8.5 . An authenticated user with Subscriber or WooCommerce Customer privileges can read restricted popup content by providing a specific post ID in the URL. T...
Malicious code in 10-shardsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7da64238cd4a48de7b5df200b6b36734be8e33dbc21e3f34a17c7235c94555 index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL...
Malicious code in 2-loadsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...
MAL-2026-14363 Malicious code in 2-loadsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...
Malicious code in 3-buildsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545 The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL,...
Malicious code in 6-viewsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68 The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and...
MAL-2026-14365 Malicious code in 6-viewsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68 The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and...