20584 matches found
Linux Distros Unpatched Vulnerability : CVE-2022-2060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site Scripting XSS - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. CVE-2022-2060 Note that Nessus relies on the presence of the package as...
Linux Distros Unpatched Vulnerability : CVE-2019-1010314
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The...
BIT-ARGO-CD-2025-55190 Argo CD: Project API Token Exposes Repository Credentials
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords...
GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...
GO-2025-3937 Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos
Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JCR lookup functionality. An attacker can execute arbitrary code by injecting malicious JNDI references that are deserialized when untrusted JNDI URIs are accepted. JNDI URIs are can be...
GHSA-CXVC-G8F2-4GMM Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data
There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup fr...
PT-2025-36652
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...
CVE-2025-58371
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
This repository contains operational information regarding the vulnerability in the Log4j logging library CVE-2021-44228. The vulnerability allows an attacker to execute arbitrary code on a system by injecting malicious data into the logging system. The repository provides a list of known...
poc
Proof of Concepts As the result of plugin writing or just general bug hunting, researchers at Tenable often stumble upon new and interesting vulnerabilities. These vulnerabililities are shared with the community on our company blog, Medium, or through our research advisories. We've decided to...
CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...
CVE-2025-58371 Roo Code is vulnerable to command injection via GitHub actions workflow
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...
MAL-2025-43529 Malicious code in astrobiology-repository-materialize-pulsar (npm)
The package astrobiology-repository-materialize-pulsar was found to contain malicious code...
Malicious code in cosmiconfig-vortex-proxima-repository (npm)
The package cosmiconfig-vortex-proxima-repository was found to contain malicious code...
Malicious code in blitz-passport-repository-venus (npm)
The package blitz-passport-repository-venus was found to contain malicious code...
Malicious code in astrobiology-repository-materialize-pulsar (npm)
The package astrobiology-repository-materialize-pulsar was found to contain malicious code...
Malicious code in paleoceanography-aurora-carina-repository (npm)
The package paleoceanography-aurora-carina-repository was found to contain malicious code...