48031 matches found
Fedora 44 : openssh (2026-c9d8542bb3)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c9d8542bb3 advisory. - CVE-2026-59996: Fix remote glob result of .. causing files to be placed in unintended parent directories when scp performs remote-to-remote copy v...
PT-2026-61316
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ethtool RSS Receive Side Scaling component. The rss prepare get function allocates the indirection table and hash key buffer through rss get data alloc, and...
PT-2026-61094
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the tcp ao delete key function within the del async path. The system incorrectly assumes that current key and rnext key pointers are always NULL on LISTE...
PT-2026-61139
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel during the handling of request key auth payloads. The problem occurs during a concurrency scenario involving the request key function an...
Linux Distros Unpatched Vulnerability : CVE-2026-63823
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka...
PT-2026-61332
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the keyring code where the find key to update function calls assoc array find without holding the RCU Read-Copy-Update read lock. RCU is a synchronization mechanism th...
Authentication Bypass
netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the getUpstream function. An attacker can gain unauthorized access to or modify data across differen...
CVE-2026-16158
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...
EUVD-2026-45373
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...
CVE-2026-16158 @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...
CVE-2026-16158 @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...
Malicious code in trongridme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 04117292d543eae5a1d22c78d8a4507cc196c8770c9fb0a09ae2f9a10a8009d4 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
CVE-2026-54335
Feathersjs contains a prototype-pollution vulnerability in the lodash-like merge helper: @feathersjs/commons .merge. In versions up to 5.0.44, merging a source object that originates from JSON.parse and contains proto , constructor, or prototype keys causes the merge to access target['proto '], m...
CVE-2026-45784
CVE-2026-45784 affects the rust-openssl crate (OpenSSL bindings for Rust), specifically CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers. The described issue is an out-of-bounds write due to incorrectly sized output buffers, allowing attacker-controlled heap corruption when the plaintex...
CVE-2026-7872
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...
DEBIAN-CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...
CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...
GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...