266080 matches found
EUVD-2026-89677
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node...
CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node...
CVE-2026-92873
The Pgpool-II software contains an incorrect implementation of an authentication algorithm . This vulnerability may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node . No specific exploitation details or remediation steps are provided in the documents.
ROOT-APP-NPM-CVE-2024-29415 CVE-2024-29415 in ip - Patched by Root
Root has patched CVE-2024-29415 in the ip package for Root:npm. Multiple fixed versions available...
Improper Validation Of Nested Digest Algorithm Sequence Elements
node-forge is vulnerable to improper validation of nested DigestAlgorithm sequence elements. The vulnerability is due to insufficient validation of element counts in the DigestAlgorithm sequence, which allows an attacker to insert garbage bytes and forge valid signatures for arbitrary messages wh...
CVE-2026-103110
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...
EUVD-2026-89587
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...
CVE-2026-103110
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...
CVE-2026-103110
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...
CVE-2026-103110
Pexip Infinity is affected by an improper input validation vulnerability in the Conferencing Node. This flaw allows a remote attacker to achieve remote code execution (RCE) as an unprivileged user . The affected versions include those before 38.2 , as well as versions 39.0, 39.1, and 40.0 . No sp...
MAL-2026-17307 Malicious code in fabric-mod-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ada8fa4c11f57f6f8bfcf158b33b56d71f6f1433910b981cec70492b2272a9 The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xy...
Malicious code in fabric-mod-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ada8fa4c11f57f6f8bfcf158b33b56d71f6f1433910b981cec70492b2272a9 The package declares scripts.postinstall = 'node index.js'. On install, index.js performs an HTTPS GET to the hardcoded host fabric-npm.gm-service.xy...
Malicious code in mfahelper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...
EUVD-2026-89483
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
PT-2026-103518
Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.9.5 Description A server-side request forgery SSRF issue exists in the canvas.present capability. This flaw allows the bypass of URL risk evaluations typically enforced by canvas.navigate. Attackers...
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790252886)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790252886 advisory. - brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the...
CVE-2026-101881: Allocation of Resources Without Limits or Throttling
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...
PT-2026-103519
Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incomplete environment-variable sanitizer in the system.run function fails to block specific variables. Attackers with gateway or agent access can supply GIT CONFIG , DOTNET START...
PT-2026-103517
Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description Incomplete validation in the system.execApprovals.set function allows the acceptance of wildcard-executable rules and abusable system binaries, such as mshta, rundll32, and certutil...
CVE-2026-101879: Missing Authorization
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...