SUSE CVE-2026-21883

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist e.g., dashboard.corp, an attacker can register a domain like dashboard.corp.attacker.com or use a subdomain if applicable and lure a victim to visit it. The...

CVE-2026-21883

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist e.g., dashboard.corp, an attacker can register a domain like dashboard.corp.attacker.com or use a subdomain if applicable and lure a victim to visit it. The...

CVE-2026-21883 Bokeh server applications have Incomplete Origin Validation in WebSockets

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist e.g., dashboard.corp, an attacker can register a domain like dashboard.corp.attacker.com or use a subdomain if applicable and lure a victim to visit it. The...

CVE-2026-21883 Bokeh server applications have Incomplete Origin Validation in WebSockets

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist e.g., dashboard.corp, an attacker can register a domain like dashboard.corp.attacker.com or use a subdomain if applicable and lure a victim to visit it. The...

Missing Origin Validation in WebSockets

Overview bokeh is an Interactive plots and applications in the browser from Python Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the matchhost function in the server/util.py file. An attacker can gain unauthorized access to sensitive data or modif...

GHSA-793V-589G-574V Bokeh server applications have Incomplete Origin Validation in WebSockets

This vulnerability allows for Cross-Site WebSocket Hijacking CSWSH of a deployed Bokeh server instance. Scope This vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability...

Fedora 42 : gobuster (2025-36b3527937)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-36b3527937 advisory. Fixes CVE-2025-58188, unretire package and update to 3.8.2. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora: Security Advisory (FEDORA-2025-36b3527937)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : gobuster (2025-723b7f2990)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-723b7f2990 advisory. Fixes CVE-2025-58188, unretire package and update to 3.8.2. Tenable has extracted the preceding description block directly from the Fedora security advisory...

EUVD-2025-38290

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, th...

CVE-2025-63690

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, th...

CVE-2025-63691

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface /api/admin/sys-token/page has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who...

pig 安全漏洞

pig is a privilege management system for pig-mesh open source. A security vulnerability exists in pig 3.8.2 and earlier versions, which originates in the Quartz management feature that can execute arbitrary Java classes via reflection, potentially leading to remote code execution...

CVE-2025-63690

The vulnerability CVE-2025-63690 affects pig-mesh Pig versions 3.8.2 and earlier, in the Quartz management function under the system management module. The issue stems from allowing reflection to instantiate any Java class with a parameterless constructor and invoke methods with String parameters...

PT-2025-45450

Name of the Vulnerable Software and Affected Versions pig-mesh versions 3.8.2 and below Description The software contains a flaw that allows for remote code execution. Specifically, when configuring scheduled tasks within the Quartz management function, located in the system management module, it...

CVE-2025-63691

In pig-mesh Pig 3.8.2 and earlier, the /api/admin/sys-token/page token query endpoint in the Token Management function (System Management) has improper permission checks, enabling information leakage. Any authenticated user can call this endpoint and retrieve plaintext authentication Tokens for a...

Slackware Linux 15.0 / current libarchive Vulnerability (SSA:2025-290-01)

The version of libarchive installed on the remote host is prior to 3.8.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-290-01 advisory. New libarchive packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

EUVD-2013-7207

Malware in sbrugna...

WordPress Marquee Addons for Elementor plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael in WordPress Plugin Marquee Addons for Elementor versions = 3.8.2...

CVE-2025-9897

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or...