CVE-2026-34048: Improper Authorization

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes...

Cisco IOS Software TACACS+ Authentication Bypass (cisco-sa-ios-tacacs-hdB7thJw)

According to its self-reported version, Cisco IOS is affected by a vulnerability. - A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.1 security update

Important: Red Hat OpenShift GitOps v1.21.1 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10083 RC 1.21.0-7: Missing permission for web-based terminal in Argocd UI GITOPS-10178 OpenShift GitOps operator v1.21.0 breaks Redis-HA...

Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PYSEC-2026-914 Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

Malicious code in neon-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8b090e304f95042a17db9e22edef03d8cdd073a214806e8aa3ebe7b2d138f9 neon-terminal advertises itself as an ANSI color helper but its CJS entry dist/index.cjs and ESM entry src/index.js each execute a shell command at t...

MAL-2026-6793 Malicious code in neon-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8b090e304f95042a17db9e22edef03d8cdd073a214806e8aa3ebe7b2d138f9 neon-terminal advertises itself as an ANSI color helper but its CJS entry dist/index.cjs and ESM entry src/index.js each execute a shell command at t...

Missing Origin Validation in WebSockets

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints whe...

Missing Origin Validation in WebSockets

Overview @theia/terminal is a Theia - Terminal Extension Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints when origin validation is bypassed due to missing or manipulated headers. An attacker c...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @eclipse-che/theia-terminal (>=0.0.1-1585667205, <=0.0.1-1601469637) +36 more potentially affected by CVE-2026-10054 via @theia/terminal (>=1.1.0-next.a62a6b92, <=1.72.3)

@theia/terminal NPM version =1.1.0-next.a62a6b92, =1.11.0, =0.0.1-1585667205, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.59.0-next.62, =1.46.0-next.241, =1.46.0-next.241, =1.17.2, =1.27.0 and more Source cves: CVE-2026-10054 Source advisory: SNYK:JS-THEIATERMINAL-17810711...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-10054

The CVE-2026-10054 entry concerns Eclipse Theia (1.8.1 and later) where the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without proper service-level authentication. The vulnerability stems from fail-open WebSocket origin valid...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

EUVD-2026-41529

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

CVE-2026-10054

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

PT-2026-55523

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.8.1 and later Description The browser backend exposes privileged terminal RPC over WebSocket endpoints '/services/shell-terminal' and '/services/terminals/:id' without service-level authentication. The WebSocket origin...

CVE-2026-10054: Missing Origin Validation in WebSockets

In affected versions of Eclipse Theia 1.8.1 and later, the browser backend exposes privileged terminal RPC over WebSocket /services/shell-terminal, /services/terminals/:id without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when...

SUSE SLES16 Security Update : loupe (SUSE-SU-2026:22380-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22380-1 advisory. This update for loupe fixes the following issue - CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can...