208518 matches found
AWS CLI: Overly permissive File Permissions
Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...
@agent-native/core (>=0.26.5, <=0.157.8), @agent-native/skills (>=0.2.9, <=0.2.558) +224 more potentially affected by CVE-2026-67327 via better-auth (>=1.1.3, <=1.6.21)
better-auth NPM version =1.1.3, =0.26.5, =0.2.9, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.1.4 and more Source cves: CVE-2026-67327 Source advisory: OSV:GHSA-QQ9H-G4JM-XGF3...
@automate.ax/components-core (>=0.1.3, <=0.3.1), @grease.sh/components-core (0.1.2) +4 more potentially affected by CVE-2026-67329 via @better-auth/stripe (>=1.6.9, <=1.6.11)
@better-auth/stripe NPM version =1.6.9, =0.1.3, =0.1.3, =0.1.0, =0.2.7 - grease.sh 0.1.2 Source cves: CVE-2026-67329 Source advisory: OSV:GHSA-H3RM-78G3-J7CP...
@automate.ax/components-core (>=0.1.3, <=0.3.1), @grease.sh/components-core (0.1.2) +4 more potentially affected by CVE-2026-67329 via @better-auth/stripe (>=1.6.9, <=1.6.11)
@better-auth/stripe NPM version =1.6.9, =0.1.3, =0.1.3, =0.1.0, =0.2.7 - grease.sh 0.1.2 Source cves: CVE-2026-67329 Source advisory: SNYK:JS-BETTERAUTHSTRIPE-18319505...
CVE-2026-64228
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-2.hum1 aarch64, x8664 clippy-1.97.1-2.hum1 aarch64, x8664 rust-1.97.1-2.hum1 aarch64, x8664 rust-analyzer-1.97.1-2.hum1 aarch64, x8664 rust-debugger-common-1.97.1-2.hum1 noarch...
GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...
31g-form-parser (1.0.107), @aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6) +448 more potentially affected by CVE-2026-55685 via react-router (>=7.0.0, <=7.17.0)
react-router NPM version =7.0.0, =1.0.0, =1.0.1, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source cves: CVE-2026-55685 Source advisory: OSV:GHSA-CHX6-HX7R-MCP5...
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...
31g-form-parser (1.0.107), @aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6) +448 more potentially affected by CVE-2026-55685 via react-router (>=7.0.0, <=7.17.0)
react-router NPM version =7.0.0, =1.0.0, =1.0.1, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source cves: CVE-2026-55685 Source advisory:...
GHSA-7G7R-GX96-252G electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
Summary AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by...
CGA-2JP2-3V53-CW87
Bulletin has no description...
CVE-2026-15243
creationtimestamp| type| source ---|---|--- 2026-07-24 12:15:03+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-15243...
CGA-545Q-M9V6-6H4X
Bulletin has no description...
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat i...
RHSA-2026:9109 Red Hat Security Advisory: containernetworking-plugins security update
Bulletin has no description...
RHSA-2026:7854 Red Hat Security Advisory: podman security update
Bulletin has no description...