13129 matches found
CVE-2026-71556 go-git: Worktree operations may follow symlinks
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...
CLSA-2026-1784077507 TuxCare security update for multer (1 CVE)
TuxCare rebuilt multer to address 1 CVE. Fixed in 1.4.5-lts.1-tuxcare.5...
CLSA-2026-1784336934 TuxCare security update for undici (4 CVEs)
TuxCare rebuilt undici to address 4 CVEs. Fixed in 5.28.5-tuxcare.5...
CLSA-2026-1783645409 TuxCare security update for 40 packages (2 CVEs)
TuxCare rebuilt 40 packages to address 2 CVEs. Fixed in 10.1.42-tuxcare.5...
CLSA-2026-1782781168 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.31-tuxcare.5...
CLSA-2026-1781484854 TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.1.20-tuxcare.5...
CLSA-2026-1779410897 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.37-tuxcare.5...
CLSA-2026-1777077480 TuxCare security update for json5 (1 CVE)
TuxCare rebuilt json5 to address 1 CVE. Fixed in 1.0.2-tuxcare.5...
CLSA-2026-1776904646 TuxCare security update for 9 packages (4 CVEs)
TuxCare rebuilt 9 packages to address 4 CVEs. Fixed in 4.5.0-tuxcare.5...
CLSA-2026-1774916696 TuxCare security update for 3 packages (2 CVEs)
TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 2.6.14-tuxcare.5...
@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)
socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...
MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...
Linux Distros Unpatched Vulnerability : CVE-2026-63033
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte...
UBUNTU-CVE-2026-61893
A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...
CVE-2026-63033
The connected records identify this CVE as affecting MZ Automation’s lib60870 library and describe an out-of-bounds read: A crafted IEC 60870-5-104 I-frame with a declared object count that exceeds the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap...
CLEANSTART-2026-UW51233 Security fixes in dynamic-localpv-provisioner 4.5.0-r1
Package dynamic-localpv-provisioner version 4.5.0-r1 fixes 2 vulnerabilities: CVE-2026-35469, ghsa-pc3f-x583-g7j2...
SUSE-SU-2026:3417-1 Security update for apptainer
This update for apptainer fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invali...
PT-2026-66630
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crafted IEC 60870-5-104 I-frame with TypeID 104 C TS NA 1 and an inflated object count causes the TestCommand getFromBuffer function to read one byte past the...
CVE-2026-56852 affecting package prometheus-process-exporter for versions less than 0.8.2-5
CVE-2026-56852 affecting package prometheus-process-exporter for versions less than 0.8.2-5. A patched version of the package is available...