DEBIAN-CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

UBUNTU-CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-18683

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

EUVD-2026-57326

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551 Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551 Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

MAL-2026-13909 Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc The package's postinstall script callback.js and its main module index.js, byte-identical to callback.js execute on both npm install and require. The...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

CVE-2026-72718

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitra...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

MAL-2026-13876 Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

MAL-2026-13865 Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df The package's postinstall script duplicated as the main module runs unconditionally on npm install. It executes id and hostname, base64-encodes the...

PT-2026-71187

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper privilege management may allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information. Recommendations At the moment, there is no information about a...

PT-2026-71325

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server version 12.10 IBM Informix Dynamic Server version 14.10 IBM Informix Dynamic Server version 15.0 Description Improper validation of user supplied input allows an unauthenticated user to execute arbitrary commands on...