PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...

Apache Tomcat 9.0.40 < 9.0.117 Improper Encoding or Escaping of Output Vulnerability (CVE-2026-34483)

The version of Tomcat installed on the remote host is 9.0.40 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache...

Linux Distros Unpatched Vulnerability : CVE-2026-14180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue...

PT-2026-70241

Name of the Vulnerable Software and Affected Versions Undertow HTTP server affected versions not specified WildFly affected versions not specified JBoss EAP affected versions not specified Description A flaw exists in the ChunkReader component of the Undertow HTTP server, which is utilized by...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...

CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

EUVD-2026-55668

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-68316

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

Malicious code in cryptostock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...

CVE-2026-66486

GNU cpio is vulnerable to improper output encoding in archive member listings. When listing members with cpio -it, member names are printed directly to output without quoting or escaping, allowing crafted member names containing newline characters or ANSI escape sequences to produce forged listin...

CVE-2026-66486 Improper Output Encoding in GNU cpio

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-66486 Improper Output Encoding in GNU cpio

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

CVE-2026-66486: Improper Encoding or Escaping of Output

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

PT-2026-69858

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

EulerOS 2.0 SP11 : python-ecdsa (EulerOS-SA-2026-3143)

According to the versions of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital...