17749 matches found
LiteLLM 1.74.2 < 1.83.7 Command Injection Vulnerability (GHSA-v4p8-mg3p-g94g)
The version of the LiteLLM Python package installed on the remote host is 1.74.2 before 1.83.7. It is, therefore, affected by a vulnerability: - From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it â POST /mcp-rest/test/connection and POST...
PT-2026-55201
Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.15.2 SUSE Rancher Fleet versions prior to 0.14.6 SUSE Rancher Fleet versions prior to 0.13.11 SUSE Rancher Fleet versions prior to 0.12.15 Description Missing validation of valuesFrom references in the He...
CVE-2026-50110
Storage Concentrator SC & SCVM contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services,...
USN-8487-1 curl vulnerabilities
Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use this issue to cause curl to use an unintended TLS configuration. CVE-2026-8286 Muhamad Arga...
CVE-2026-54514
A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS Domain Name System query. This occurs when untrusted JSON input containing specific network address information is...
Malicious code in cursed-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...
Improper Trusted Types Policy Reuse
DOMPurify is vulnerable to improper trusted types policy reuse. The vulnerability is due to the reuse of a previously supplied TRUSTEDTYPESPOLICY after clearConfig is called, which allows an attacker to obtain a TrustedHTML object generated under an unintended policy when RETURNTRUSTEDTYPE is...
Security update for perl-Config-IniFiles
This update for perl-Config-IniFiles fixes the following issue CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
SUSE-SU-2026:2710-1 Security update for perl-Config-IniFiles
This update for perl-Config-IniFiles fixes the following issue - CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236...
Security update for perl-Config-IniFiles
This update for perl-Config-IniFiles fixes the following issue CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
SUSE-SU-2026:2709-1 Security update for perl-Config-IniFiles
This update for perl-Config-IniFiles fixes the following issue - CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236...
MAL-2026-6673 Malicious code in anthropic-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90ec82c6478e3a82eac71597b1c1fffc17d1b138e11e1a2aeadec7c00344c65e [email protected] is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its declared main dist/index.js i...
Malicious code in log-taker1 (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...
Malicious code in console-fmt-cli (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. console-fmt-cli uses a side-loader technique: it declares decimal-format-core =3.0 as a dependency, which contains a dropper that executes at install time via a postinstall hook. The dropper fetches a...
Amazon Linux 2023 : rclone (ALAS2023-2026-1907)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1907 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD reques...
Security update for perl-Config-IniFiles (important)
openSUSE security update: security update for perl-config-inifiles ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21012-1 Rating: important References: bsc1268236 Cross-References: CVE-2026-11527 CVSS scores: CVE-2026-11527 SUSE : 8.6...
com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.22), org.apache.tomee:apache-tomee (11.0.0-m1) +10 more potentially affected by CVE-2026-50229 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.22)
org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =3.0.0, =3.0.0, =11.0.0, =11.1.2 Source cves: CVE-2026-50229 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734719...
com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.55), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.55)
org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734714...
com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.4) potentially affected by CVE-2026-55957 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.4)
org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.4 Source cves: CVE-2026-55957 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733812...
com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.36), org.apache.tomee:apache-tomee (>=10.0.0-m1, <=10.0.0) +10 more potentially affected by CVE-2026-55957 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.36)
org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2026-55957 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17733812...