143887 matches found
GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...
31g-form-parser (1.0.107), @aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6) +445 more potentially affected by CVE-2026-55685 via react-router (>=7.0.0, <=7.17.0)
react-router NPM version =7.0.0, =1.0.0, =1.0.1, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source cves: CVE-2026-55685 Source advisory: OSV:GHSA-CHX6-HX7R-MCP5...
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat i...
RHSA-2026:44694 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:44522 Red Hat Security Advisory: kernel security update
Bulletin has no description...
RHSA-2026:44438 Red Hat Security Advisory: compat-openssl11 security update
Bulletin has no description...
RHSA-2026:44480 Red Hat Security Advisory: compat-openssl10 security update
Bulletin has no description...
PYSEC-2026-3447
creationtimestamp| type| source ---|---|--- 2026-07-24 09:40:25+00:00| seen| https://gist.github.com/sw1pp3r/00f32e3393b6c6123cc7aeaff3ed9f18...
GHSA-4MP9-239F-G9HG vulnerabilities
Vulnerabilities for packages: metabase, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, strimzi-kafka-operator, apache-activemq-artemis, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, tinkerpop, cloudwatch-exporter, apache-hop-fips, reposilite,...
GHSA-6CQP-G7GG-8HR5 vulnerabilities
Vulnerabilities for packages: metabase, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, strimzi-kafka-operator, apache-activemq-artemis, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, tinkerpop, cloudwatch-exporter, apache-hop-fips, reposilite,...
GHSA-Q4F6-JM68-57WW vulnerabilities
Vulnerabilities for packages: metabase, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, strimzi-kafka-operator, apache-activemq-artemis, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, tinkerpop, cloudwatch-exporter, apache-hop-fips, reposilite,...
GHSA-WC96-39FC-566F vulnerabilities
Vulnerabilities for packages: thingsboard, cassandra, tez, management-api-for-apache-cassandra-5.0...
GHSA-G7HG-VRCF-MVMR vulnerabilities
Vulnerabilities for packages: thingsboard, cassandra, tez, management-api-for-apache-cassandra-5.0...
CVE-2026-13077
creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:03+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...
CVE-2026-66141
Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled...
CVE-2026-66140
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled...