Node.js security vulnerabilities

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Versions 20, 22, 24, and 25 of Node.js contain security vulnerabilities. These vulnerabilities stem from the futimes function in the permission model not performing the expected write...

MiracleLinux 9 : rpm-4.16.1.3-27.el9_3 (AXSA:2024-7473:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7473:01 advisory. rpm: TOCTOU race in checks for unsafe symlinks CVE-2021-35937 rpm: races with chown/chmod/capabilities calls during installation CVE-2021-35938 rpm:...

MiracleLinux 7 : flatpak-1.0.9-13.0.1.el7.AXS7 (AXSA:2024-8901:07)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8901:07 advisory. CVE-2024-42472: access to files outside sandbox for apps using persistent directories CVEs: CVE-2024-42472 Flatpak is a Linux application sandboxing and...

CVE-2026-23877 Directory Traversal & Filesystem can be accessed by a non-admin user

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's listfolders function in the /folder/dir-browser endpoint is vulnerable to directory traversal attacks. Any authenticated user including non-admin can browse arbitrary directories on the server...

The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to compromise the system.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability can allow an attacker to compromise the system...

MiracleLinux 4 : openssh-5.3p1-122.AXS4 (AXSA:2017-1374:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1374:01 advisory. SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure...

CVE-2026-22915

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

MiracleLinux 4 : kernel-2.6.32-754.12.1.el6 (AXSA:2019-3870:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3870:02 advisory. kernel: Missing check in fs/inode.c:inodeinitowner does not clear SGID bit on non-directories for non-members CVE-2018-13405 Tenable has extracted the...

MiracleLinux 7 : policycoreutils-2.5-22.el7 (AXSA:2018-2922:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2922:01 advisory. policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead CVE-2018-1063 Tenable has extracted the...

CVE-2026-22915

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

CVE-2026-22915

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

EUVD-2026-2814

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

CVE-2026-22915

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

CVE-2026-22915

CVE-2026-22915 is described across multiple feeds as a low-privilege read-disclosure affecting unspecified directory paths on the device. Public documents consistently state attacker cannot escalate privileges beyond low level and no active exploits are reported in PSIRT/SICK sources. Red Hat and...

CVE-2026-22915

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information...

PT-2026-2996

Name of the Vulnerable Software and Affected Versions versions prior to 2026-22915 Description An attacker with limited access rights could potentially read files from designated directories on a device, which may lead to the disclosure of confidential data. Approximately zero devices are estimat...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003102 advisory. The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where...

CVE-2022-50890

Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. Attackers can exploit the vulnerability by crafting GET requests with directory traversal sequences to access restricted system directories on the...

Linux Distros Unpatched Vulnerability : CVE-2025-55132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes even when the process has only read permission...

CVE-2022-50890

Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. Attackers can exploit the vulnerability by crafting GET requests with directory traversal sequences to access restricted system directories on the...