30405 matches found
Important: Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
resterm v0.51.2
Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...
Malicious code in tailwind-opentype (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb dist/index.js re-exports a benign Tailwind plugin and appends an evalatob... payload that runs when the module is required e.g. from a project's...
MAL-2026-12222 Malicious code in tailwind-opentype (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb dist/index.js re-exports a benign Tailwind plugin and appends an evalatob... payload that runs when the module is required e.g. from a project's...
CVE-2026-71209
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026
Summary In addition to updating many operating system level packages, IBM Business Automation Workflow container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated valu...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...
CVE-2026-71215
art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root. Because path.resolve discards ro...
EUVD-2026-53212
art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root. Because path.resolve discards ro...
CVE-2026-71209
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route...
EUVD-2026-53206
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route...
CVE-2026-71209
Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...
CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
CVE-2026-71209
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
EUVD-2026-53195
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a pathworkdir, p helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because...
CVE-2026-55747
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a pathworkdir, p helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because...
IXON VPN Client
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...