@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50184 via @angular/service-worker (>=19.0.0-next.9, <=19.2.20)

@angular/service-worker NPM version =19.0.0-next.9, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50184 Source advisory: MEND:CVE-2026-50184...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0-rc.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0-rc.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: MEND:CVE-2026-50169...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-54264 via @angular/service-worker (>=20.0.0-rc.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0-rc.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-54264 Source advisory: MEND:CVE-2026-54264...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by CVE-2026-10561 via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: CVE-2026-10561 Source advisory: MEND:CVE-2026-10561...

postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...

AlmaLinux 8 : 389-ds:1.4 (ALSA-2026:26459)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26459 advisory. 389-ds-base: 389-ds-base: unbounded LDAP controls count in getldapmessagecontrolsext causes CPU and heap amplification remote DoS CVE-2026-9064 Tenable has...

Important: postgresql:15 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite...

ALSA-2026:27738 Important: libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq: Buffer...

Fedora 44 : 389-ds-base (2026-6d00814a85)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d00814a85 advisory. Resolves: CVE-2026-9064 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

RockyLinux 10 : 389-ds-base (RLSA-2026:26456)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26456 advisory. 389-ds-base: 389-ds-base: unbounded LDAP controls count in getldapmessagecontrolsext causes CPU and heap amplification remote DoS CVE-2026-9064 Bug Fixes and...

NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory vulnerability discovered by ? in WordPress Npm network-ai versions = 5.12.1...

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...

GHSA-JVCM-F35G-W78P Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...

GHSA-P9XJ-FPR2-JF2Q symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

Description The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative, which returns true for paths like ../../../etc. Path::join then resolves the .. segments without complaint, so the...

GHSA-CCV6-R384-XP75 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Summary All components based on BaseFileComponent are vulnerable to the following vulnerability: 1. Docling DoclingInlineComponent 2. Docling Serve DoclingRemoteComponent 3. Read File FileComponent 4. NVIDIA Retriever Extraction NvidiaIngestComponent 5. Video File VideoFileComponent 6. Unstructur...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-55447 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-55447 Source advisory: SNYK:PYTHON-LFX-17400345...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the logout. An attacker can maintain unauthorized access to a user's session by exploiting improper clearing of authentication cookies and tokens after logout. This may allow continued access to...

dzbanek-langflow-base (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-55423 via lfx (0.1.13)

lfx PYPI version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - dzbanek-langflow-base =0.6.0, =0.6.1 Source cves: CVE-2026-55423 Source advisory: SNYK:PYTHON-LFX-17400336...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getflowbyidorendpointname function. An attacker can access and execute flows belonging to other users, potentially exposing sensitive data and consuming resources, by specifying t...

homeassistant-stubs (2022.8.7), mqtt-hass-base (>=4.0.0, <=4.0.7) +1 more potentially affected by CVE-2026-54317 via homeassistant (2022.8.7)

homeassistant PYPI version 2022.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.7 - mqtt-hass-base =4.0.0, =4.0.7 - pytest-homeassistant-custom-component 0.11.12 Source cves:...