2214 matches found
GHSA-2XX6-QF7X-GRQH next-npm-version is vulnerable to Command injection
NPM package next-npm-version1.0.1 is vulnerable to Command injection...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the downloadFrom and webhook processes. An attacker can access internal network resources and potentially exfiltrate sensitive information or interact with internal-only services by supplying special...
CVE-2025-63706
The CVE-2025-63706 entry concerns the NPM package next-npm-version1.0.1 , reported as vulnerable to command injection . Multiple connected records corroborate the issue across NVD/CVE and related feeds. The vulnerability is described as critical with a CVSS 3.1 base score of 9.8 (vectors: AV:N/AC...
PT-2026-38453
Name of the Vulnerable Software and Affected Versions query-parser-string version 1.0.0 Description The software is subject to Prototype Pollution, a condition where an attacker can manipulate the prototype of an object to alter the behavior of the application. This occurs because the package fai...
GHSA-75XQ-5H9V-W6PX vulnerabilities
Vulnerabilities for packages: jruby, ruby3.2-net-imap, ruby3.4-net-imap, ruby4.0-net-imap, ruby3.3-rails, ruby4.0-rails, logstash, kube-fluentd-operator, ruby3.4-rails, ruby3.3-net-imap, kube-logging-operator, ruby3.2-rails...
GHSA-WPQR-6V78-JR5G vulnerabilities
Vulnerabilities for packages: gemini-cli...
AlmaLinux 9 : python-tornado (ALSA-2026:13670)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:13670 advisory. tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 tornado: Tornado: Cookie attribute injection due to improper handlin...
RHEL 9 : sudo (RHSA-2026:13889)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13889 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...
Fedora 43 : insight (2026-e0f5e87dd6)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e0f5e87dd6 advisory. Fix CVE-2026-6846. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
MiracleLinux 9 : grafana-pcp-5.1.1-14.el9_7 (AXSA:2026-539:06)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-539:06 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses qs-6.14.1.tgz which is vulnerable to CVE-2026-2391.
Summary IBM Maximo Application Suite - Monitor Component uses qs-6.14.1.tgz which is vulnerable to CVE-2026-2391. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for...
GHSA-FH64-R2VC-XVHR vulnerabilities
Vulnerabilities for packages: mlflow-fips, mlflow...
Eval Injection
Overview verl is a verl: Volcano Engine Reinforcement Learning for LLM Affected versions of this package are vulnerable to Eval Injection via the mathequal function. An attacker can execute arbitrary code by supplying crafted input that is processed by an unsafe evaluation mechanism. Remediation...
CVE-2026-34478 vulnerabilities
Vulnerabilities for packages: spark-kubernetes-operator, kserve-modelmesh, apache-tika-fips, logstash, camunda-zeebe, commercial-elasticsearch, spark-fips, spark-kubernetes-operator-fips, kafka-bridge, hadoop-fips, kafka-fips, elasticsearch-fips, apache-camel-karavan-devmode, apache-pulsar, akhq,...
CVE-2025-57735 vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2026-39399
The CVE affects NuGetGallery, specifically the backend job that processes .nuspec files inside NuGet packages. A crafted nuspec with malicious metadata can trigger cross-package metadata injection due to insufficient input validation, potentially enabling remote code execution (RCE) and arbitrary...
Debian: Security Advisory (DLA-4530-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2026-1559)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1559 advisory. In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation...