42226 matches found
GHSA-XP8H-82PC-F6JM vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-VMF3-W455-68VH vulnerabilities
Vulnerabilities for packages: pnpm-stage0, wazuh-dashboard-fips, tileserver-gl, prism, lerna, gemini-cli, sqlpad, drupal, kubeflow-katib, actions-runner, graalvm, py3-jupyterlab, tensorflow-cpu-jupyter, saf, homepage, npm, gitlab-rails-ce-fips, thingsboard-fips, code-server, kibana,...
GHSA-R7G4-QG5F-QQM2 vulnerabilities
Vulnerabilities for packages: langfuse...
GHSA-4X5R-PXFX-6JF8 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, langfuse, ts-patch, airflow, vitess...
CVE-2026-12321 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-54105
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...
EUVD-2026-37913
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network...
CVE-2026-54106
CVE-2026-54106 affects the U.S. GAO EPDS and CBCA EDS login flow, where X-Forwarded-For headers are not validated. The underlying issue allows a remote attacker who has compromised administrator credentials to bypass network access controls and log in, potentially gaining access to restricted doc...
CVE-2026-54104
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...
EUVD-2026-37911
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...
MAL-2026-6119 Malicious code in parket-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d62a38af75a45a91e590e0cffe4f58e900fe726b4323af1e481118d146277c index.js imports childprocess and invokes execSync with bash and zsh shells lines 315 and 331. Without traced reachability, it is not established...
CVE-2026-7210 vulnerabilities
Vulnerabilities for packages: python...
AzeoTech DAQFactory (Update A)
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...
MAL-2026-6111 Malicious code in @rafaelsene01/agent-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator declared as a...
CVE-2026-8806
creationtimestamp| type| source ---|---|--- 2026-06-18 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-06 2026-06-19 03:48:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3momgpageit2x...
GHSA-993G-76C3-P5M4 vulnerabilities
Vulnerabilities for packages: kserve, datadog-agent, superset, ggshield...
SUSE CVE-2026-50133
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html" had their body emitted verbatim...
SUSE CVE-2026-50269
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing...