368 matches found
ROOT-OS-DEBIAN-12-CVE-2025-5372 CVE-2025-5372 in libssh - Patched by Root
Root has patched CVE-2025-5372 in the libssh package for Root:Debian:12. Multiple fixed versions available...
Astra Linux – Vulnerability in Python 3.7, Python 2.7
There is a flaw in the urllib’s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server to which an HTTP client such as a web browser connects can trigger a Regular Expression Denial of Service ReDOS during an authentication request. This occurs when the server sends a...
Astra Linux – Vulnerability in Python 3.11, Python 3.7
When an address list is folded, and the separating comma ends up on a folded line that needs to be encoded using Unicode, then the separator itself must also be encoded using Unicode. The expected behavior is that the separating comma remains a plain comma. However, this can lead to the address...
Astra Linux – Vulnerability in Python 3.11, Python 3.7
The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...
Astra Linux – Vulnerability in Python 2.7, Python 3.7
A use-after-free exists in Python through version 3.9 via the heappushpop function in the heapq module...
Astra Linux – Vulnerability in Python 3.7, PHP 7.3
The Keccak XKCP SHA-3 reference implementation, prior to the update of fdc6fef, has an integer overflow and resulting buffer overflow issue. This vulnerability allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the algorithm. This issue occurs within...
Astra Linux – Vulnerability in Python 2.7, Python 3.7
A flaw was discovered in Python, specifically in the FTP File Transfer Protocol client library when operating in PASV passive mode. The issue arises from how the FTP client defaults to trusting the host based on the PASV response. This flaw allows an attacker to create a malicious FTP server that...
Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Python 2.7
When using http.cookies.Morsel, user-controlled cookie values and parameters may allow the injection of HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters...
CLSA-2026-1784683091 TuxCare security update for immutable (1 CVE)
TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.2...
CVE-2026-69085
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint. The caller-supplied keyword is concatenated into SQL without escaping or parameter binding, and the statement can execute on a read-write SQLite handle via a driver that supports stacked statemen...
PT-2026-67406
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or...
GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...
Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...
SUSE CVE-2026-54158
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view database cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or " breaks out of its surrounding tag and runs arbitrary...
CLEANSTART-2026-RB15576 Security fixes in kyverno-policy-reporter-fips 3.7.3-r1
Package kyverno-policy-reporter-fips version 3.7.3-r1 fixes 3 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-39883...
CLEANSTART-2026-ZU41550 Security fixes in elastic-beats 9.3.7-r0
Package elastic-beats version 9.3.7-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...
CLEANSTART-2026-KC30939 Security fixes in argo-workflows-fips 3.7.8-r2
Package argo-workflows-fips version 3.7.8-r2 fixes 7 vulnerabilities: ghsa-fw7p-63qq-7hpr, ghsa-q9hv-hpm4-hj6x, ghsa-9h8m-3fm2-qjrq, CVE-2026-26958, CVE-2026-1229...
CLEANSTART-2026-CJ46936 Security fixes in kyverno-policy-reporter-fips 3.7.2-r0
Package kyverno-policy-reporter-fips version 3.7.2-r0 fixes 2 vulnerabilities: CVE-2026-26958, ghsa-fw7p-63qq-7hpr...
CLEANSTART-2026-JK70827 Security fixes in elasticsearch 9.3.7-r1
Package elasticsearch version 9.3.7-r1 fixes 5 vulnerabilities: CVE-2026-54399, CVE-2026-54428, CVE-2026-41715, CVE-2026-42579, CVE-2026-45536...