11759 matches found
CVE-2026-7820: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts CWE-307 in pgAdmin 4. pgAdmin enforces MAXLOGINATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.initapp and is reachable on every server, never...
CVE-2026-7819: UNIX Symbolic Link (Symlink) Following
Symbolic-link path traversal CWE-61, CWE-22 in pgAdmin 4 File Manager. checkaccesspermission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storag...
CVE-2026-7817: Files or Directories Accessible to External Parties
Local file inclusion LFI and server-side request forgery SSRF vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-supplied apikeyfile and apiurl preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by...
CVE-2026-4897 affecting package polkit for versions less than 123-4
CVE-2026-4897 affecting package polkit for versions less than 123-4. A patched version of the package is available...
CVE-2026-42455: Improper Neutralization of Input During Web Page Generation
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint POST /api/v1/archives/linkId?format=4 accepts HTML files text/html without sanitizing JavaScript content. When the archive i...
OSGeo GDAL buffer error vulnerability
OSGeo GDAL is an open-source geospatial raster and vector data processing library developed by OSGeo. Versions of OSGeo GDAL 3.13.0dev-4 and earlier contain a buffer error vulnerability. This vulnerability stems from a function in the Grid File Handler component, specifically the function...
python311-Django4-4.2.30-2.1 on GA media (moderate)
python311-Django4-4.2.30-2.1 on GA media Announcement ID: openSUSE-SU-2026:10708-1 Rating: moderate Cross-References: CVE-2026-35192 CVE-2026-5766 CVE-2026-6907 CVSS scores: CVE-2026-35192 SUSE : 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2026-35192 SUSE : 2.3...
[SECURITY] [DLA 4572-1] linux security update
Debian LTS Advisory DLA-4572-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings May 08, 2026 https://wiki.debian.org/LTS Package : linux Version : 5.10.251-4 CVE ID : CVE-2026-43284 CVE-2026-43500 Two vulnerabilities have been discovered in the Linux kernel that may...
CVE-2023-46453: Improper Neutralization of Special Elements used in an SQL Command
Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...
GDAL buffer error vulnerability
GDAL is an open-source geospatial data abstraction library developed by GDAL. Versions of GDAL 3.13.0dev-4 and earlier contain a buffer error vulnerability. This vulnerability stems from the operation of the parameter DataFieldName in the function GDnentries within the file...
CVE-2026-34003 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4
CVE-2026-34003 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...
CVE-2026-33999 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4
CVE-2026-33999 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...
CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4
CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...
RHCOS 4 : OpenShift Container Platform 4.2.29 openshift (RHSA-2020:1527)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1527 advisory. - kubernetes: Use of unbounded 'client' label in apiserverrequesttotal allows for memory exhaustion CVE-2020-8552 Note that Nessus has not...
RHCOS 4 : OpenShift Container Platform 4.5.27 (RHSA-2021:0034)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0034 advisory. - jenkins-2-plugins/subversion: XML parser is not preventing XML external entity XXE attacks CVE-2020-2304 -...
RHCOS 4 : OpenShift Container Platform 4.6.23 (RHSA-2021:0956)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0956 advisory. - golang: data race in certain net/http servers including ReverseProxy can lead to DoS CVE-2020-15586 - golang: ReadUvarint and...
RHCOS 4 : OpenShift Container Platform 4.9.25 (RHSA-2022:0860)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0860 advisory. - CRI-O: Arbitrary code execution in cri-o via abusing kernel.corepattern kernel parameter CVE-2022-0811 Note that Nessus has not tested for...
CVE-2026-28780
Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue...
requests-hardened is Vulnerable to Server-Side Request Forgery
The SSRF protection in requests-hardened prior to version 1.2.1 fails to block IP addresses within the RFC 6598 Shared Address Space 100.64.0.0/10. An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This i...
