36649 matches found
Malicious code in core-tailwindcss-utility (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...
SUSE CVE-2026-53791
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...
AlmaLinux 10 : nodejs22 (ALSA-2026:55541)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...
Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory. - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257...
MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...
Linux Distros Unpatched Vulnerability : CVE-2026-72421
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly ...
CVE-2026-75856: Server-Side Request Forgery (SSRF)
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to intern...
Linux Distros Unpatched Vulnerability : CVE-2026-72417
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl...
nodejs:22 security update
nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 1:22.23.1-3 - deps: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 nodejs-nodemon nodejs-packag...
PT-2026-77157
Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description A server-side request forgery SSRF bypass exists in the DNS pinning logic. The issue stems from a failure to prevent time-of-check-time-of-use TOCTOU attacks, where a race condition occurs between...
Oracle Linux 10 : nodejs22 (ELSA-2026-55541)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55541 advisory. - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 npm/brace-expansion - Fix for CVE-2026-59873 and...
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...
CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...
CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
Important: Red Hat Security Advisory: nodejs:24 security update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification
A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...