@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: MEND:CVE-2026-102990...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

The basic-ftp FTP client for Node.js (prior to version 6.2.1 ) is vulnerable to a quadratic-time CPU denial of service . A malicious or compromised FTP server can trigger this by providing a crafted directory listing where the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent ...

EUVD-2026-90210

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43...

EUVD-2026-90201

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-74865

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865

The sogo_yhn component contains an authentication bypass vulnerability caused by the configuration parameter SOGoTrustProxyAuthentication=YES. This configuration allows an unauthenticated attacker to bypass password requirements during HTTP Basic authentication by providing a valid username and a...

EUVD-2026-89797

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865 Authentication Bypass in sogo_yhn

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865 Authentication Bypass in sogo_yhn

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-74865: Authorization Bypass Through User-Controlled Key

sogoyhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's accoun...

CVE-2026-102990: Inefficient Regular Expression Complexity

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

PT-2026-103521

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fiel...

AlmaLinux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1775809438)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775809438 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CVE-2026-103585: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting XSS. This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43...

PT-2026-103128

sogo yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's...

Rocky Linux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1775809438)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775809438 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

`basic-toml` is unmaintained

The last release was on March 3, 2025, the day after the repository was archived and marked as unmaintained. Possible alternatives - toml...

EUVD-2026-87326

GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...