Oracle Linux 9 : jmc (ELSA-2026-0752)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-0752 advisory. 8.2.0-4 - Bump LZ4 Version to 1.10.2. Related: RHEL-135478 Tenable has extracted the preceding description block directly from the Oracle Linux security advisor...

CVE-2025-66518

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

CVE-2025-66518

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

CVE-2025-66518 Apache Kyuubi: Unauthorized directory access due to missing path normalization

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

CVE-2025-66518 Apache Kyuubi: Unauthorized directory access due to missing path normalization

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade t...

PT-2026-1236

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.6.0 through 1.10.2 Description A path traversal issue exists in the Apache Kyuubi server. Clients accessing the server via Kyuubi frontend protocols can bypass the server-side configuration...

CVE-2024-58290

Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or...

DeoThemes Xhibiter NFT Marketplace SQL注入漏洞

DeoThemes Xhibiter NFT Marketplace is a website builder from DeoThemes, Inc. A SQL injection vulnerability exists in DeoThemes Xhibiter NFT Marketplace version 1.10.2, which originates from an SQL injection in the id parameter in the collections endpoint, which could lead to the disclosure or...

EUVD-2022-3515

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-4922

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nomad Community and Nomad Enterprise Nomad prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified a...

Linux Distros Unpatched Vulnerability : CVE-2016-9813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The parsepat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service NULL pointer dereference and crash vi...

Linux Distros Unpatched Vulnerability : CVE-2017-16042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command...

Incorrect Privilege Assignment

Overview github.com/hashicorp/nomad/command/agent is a package part of hashicorp's nomad. Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to prefix-based ACL policy lookups. An attacker with knowledge of existing job names and permission to create a job can...

CVE-2025-4922 Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job

Nomad Community and Nomad Enterprise “Nomad” prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14...

CVE-2025-4922 Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job

Nomad Community and Nomad Enterprise “Nomad” prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14...

CVE-2024-33831

A stored cross-site scripting XSS vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field...

CVE-2023-52121

Cross-Site Request Forgery CSRF vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a...

PYSEC-2024-201

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on...

CVE-2024-49377

OctoPrint (web UI for controlling 3D printers) up to version 1.10.2 is affected by reflected XSS in the Jinja2 templates used for the login dialog and the standalone application key confirmation dialog. An attacker could lure a victim to click a crafted login link or trigger the application key w...

CVE-2024-51493 API key access in settings without reauthentication in OctoPrint

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user...