13049 matches found
CVE-2026-25681 affecting package cni-plugins for versions less than 1.4.0-6
CVE-2026-25681 affecting package cni-plugins for versions less than 1.4.0-6. A patched version of the package is available...
CVE-2026-53094 affecting package kernel for versions less than 6.6.143.1-1
CVE-2026-53094 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-43973 affecting package rabbitmq-server for versions less than 3.13.7-6
CVE-2026-43973 affecting package rabbitmq-server for versions less than 3.13.7-6. A patched version of the package is available...
CVE-2026-48142 affecting package nginx for versions less than 1.28.3-6
CVE-2026-48142 affecting package nginx for versions less than 1.28.3-6. A patched version of the package is available...
CVE-2026-55448 mise: Local credential_command executes untrusted config
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
AZL-90396 CVE-2026-53258 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev-intscanreq is leaked if cfg80211scan fails. Note that it's supposed to be released at cfg80211scandone but this doesn't happen as rdev-scanreq is NULL at that point, too, leading ...
AlmaLinux 8 : redis:6 (ALSA-2026:26008)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26008 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...
RockyLinux 8 : redis:6 (RLSA-2026:26008)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26008 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...
NPM: protobufjs : Schema-derived names can shadow runtime-significant properties
NPM: protobufjs : Schema-derived names can shadow runtime-significant properties vulnerability discovered by ? in WordPress Npm protobufjs versions = 7.6.2...
CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...
CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...
PT-2026-48962
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.80 Parse Server versions prior to 9.9.1-alpha.6 Description A relation query using the $relatedTo operator allows an unauthenticated client to read the membership of a Relation field. This occurs even if the...
CVE-2026-40884
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP...
CVE-2026-41257 affecting package jq for versions less than 1.7.1-6
CVE-2026-41257 affecting package jq for versions less than 1.7.1-6. A patched version of the package is available...
CVE-2026-44777 affecting package jq for versions less than 1.7.1-6
CVE-2026-44777 affecting package jq for versions less than 1.7.1-6. A patched version of the package is available...
CVE-2026-40612 affecting package jq for versions less than 1.7.1-6
CVE-2026-40612 affecting package jq for versions less than 1.7.1-6. A patched version of the package is available...
@beemstream/keystone-document-gallery (>=2.0.0, <=2.0.6), @k6js/admin-ui (>=0.3.0-20250618-02, <=0.4.7) +19 more potentially affected by CVE-2026-10802 via @keystone-6/core (>=1.1.1, <=8.0.6)
@keystone-6/core NPM version =1.1.1, =2.0.0, =0.3.0-20250618-02, =1.0.17, =1.0.19, =0.0.1, =2.1.0-beta.0, =2.1.0-beta.0, =0.0.1-alpha.1, =1.0.0, =6.0.21, =1.0.0, =1.0.3, =1.0.12 and more Source cves: CVE-2026-10802 Source advisory: SNYK:JS-KEYSTONE6CORE-17179719...
@k6js/admin-ui (>=0.3.0-20250618-02, <=0.4.7), @kids-reporter/cms-core (>=1.0.17, <=1.0.36) +5 more potentially affected by CVE-2026-10802 via @keystone-6/core (>=6.5.1, <=6.5.3)
@keystone-6/core NPM version =6.5.1, =0.3.0-20250618-02, =1.0.17, =1.0.19, =0.0.1, =1.0.0, =5.0.1 - keystone-plugin-all-in-one-accessibility 1.0.1 Source cves: CVE-2026-10802 Source advisory: OSV:GHSA-45JQ-C8XM-JFW9...
CVE-2026-35193 Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the Vary response header for requests bearing that header without Cache-Control: public, which allows remote attackers to read private...