27559 matches found
MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...
PT-2026-68229
Name of the Vulnerable Software and Affected Versions Cisco Terminal Service TS Agent affected versions not specified Description A flaw in the network driver allows an authenticated remote attacker to bypass firewall rules linked to their own account. This occurs because of an incorrect mapping ...
PT-2026-68262
Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...
PT-2026-68062
Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description A denial-of-service issue exists in multiple TLS listeners within the Rancher server and the cattle-cluster-agent component. These components utilize the dynamiclistener library to handle TLS...
SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:3472-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3472-1 advisory. This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:3471-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3471-1 advisory. This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
Fedora 45 : rust-crypto-auditing / rust-crypto-auditing-agent / etc (2026-160ff29e13)
The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-160ff29e13 advisory. Update to 0.3.2 release with security fixes in dependencies: - RUSTSEC-2026-0007 - RUSTSEC-2026-0009 Tenable has extracted the preceding description block...
CVE-2026-55747: Improper Limitation of a Pathname to a Restricted Directory
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...
PT-2026-68316
Name of the Vulnerable Software and Affected Versions livebook versions 0.13.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8 Description An OS Command Injection issue exists where deployment setup commands are generated without proper shell escaping of environment variable values. The...
CVE-2026-20028: Incorrect Privilege Assignment
A vulnerability in the network driver of Cisco Terminal Service TS Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker. This vulnerability is due to an incorrect mapping of network connections to user accounts. An...
PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents
Smart-home assistants increasingly use multimodal large language models MLLMs that perceive video and audio directly. This raises a safety question specific to the home: can the agent tell a genuine user command from ambient or externally-sourced content, television speech, on-screen text, or an...
PT-2026-68261
Name of the Vulnerable Software and Affected Versions Remoting versions prior to 3384.v60d89463d9e0 excluding version 3355.3357.v931d3c992987 Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description The JEP-200 class filter is not applied to classes resolved via a fallbac...
PT-2026-67942
Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support versions prior to 1.17.5 Description An issue exists where authenticated attackers with the CRM Agent role, CRM Manager role, or WordPress administrator privileges, and the...
CVE-2026-55996: Allocation of Resources Without Limits or Throttling
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...
Endpoint Manager client program Code Execution Full Control
The vulnerability of the Endpoint Manager client program and the Detection Agent for the UEM system’s centralized management, monitoring, and security solutions, such as LANSCOPE Endpoint Manager On-Premise Edition, is related to insufficient verification of the communication channel source...
CVE-2026-70426: Deserialization of Untrusted Data
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...
VulnCheck KEV: CVE-2026-63077
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol...
Standalone Veeam Agent for Unix Fails to Connect to Veeam Backup Server After Certificate Changed Twice
Challenge Veeam Agent for IBM AIX or Veeam Agent for Oracle Solaris operating in standalone mode is unable to connect to its configured Veeam Backup Server. Backup jobs fail to start, and attempts to resynchronize or edit the connection fail with the following error: Self-signed certificate This...
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol...
Agent-to-controller deserialization filter bypass
Jenkins uses the https://github.com/jenkinsci/remotingRemoting library typically agent.jar or remoting.jar for communication between the controller and agents via serialized Java objects. To protect against deserialization vulnerabilities, Jenkins enforces the https://jenkins.io/jep/200JEP-200...