23434 matches found
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Summary web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination validation...
Interpretation Conflict
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Interpretation Conflict via the file upload process. An attacker can cause files to be served with an unintended Content-Typ...
CVE-2026-3571
creationtimestamp| type| source ---|---|--- 2026-04-04 04:11:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3minejyuzrp25 2026-04-10 10:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mj54ixzout2r...
CVE-2026-2924 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for...
GHSA-HQMJ-H5C6-369M vulnerabilities
Vulnerabilities for packages: py3-onnx...
CVE-2026-34774
creationtimestamp| type| source ---|---|--- 2026-04-04 01:19:10+00:00| published-proof-of-concept| Telegram/7aT9UpYbZ02LD1lZLti1mg9cdxIpZxAoIiq3Sp7jGujjzO4 2026-04-04 02:23:00+00:00| seen| https://bsky.app/profile/potato.software/post/3min6igaak62k 2026-04-04 02:23:00+00:00| seen|...
[SECURITY] Fedora 43 Update: chromium-146.0.7680.177-1.fc43
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 43 Update: tcpflow-1.6.2-0.1.8d47b53.fc43
tcpflow is a program that captures data transmitted as part of TCP connections flows, and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being...
[SECURITY] Fedora 43 Update: libgsasl-1.10.0-15.fc43
The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms...
[SECURITY] Fedora 43 Update: python3.9-3.9.25-7.fc43
Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...
sheed AntiVirus 代码问题漏洞
Sheed AntiVirus is a basic anti-virus software developed by Sheed AntiVirus Corporation. Version 2.3 of Sheed AntiVirus has a code vulnerability; this vulnerability stems from the ShavProt service having a service path that lacks quotes, which may allow local attackers to exploit the binary path ...
Photon OS 4.0: Python3 PHSA-2026-4.0-0991
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0991. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
MiracleLinux 8 : python3.11-3.11.13-6.el8_10 (AXSA:2026-393:08)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-393:08 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly...
EUVD-2026-18903
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra default docker-compose deployment contains a SQL Injection vulnerability that leads to Remote Code Execution RCE in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated,...
EUVD-2026-18874
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including...
GHSA-3VFF-HJQV-M7H8 JupyterHub has an Open Redirect Vulnerability
Affected Version JupyterHub = 5.4.3 Impact An open redirect vulnerability in JupyterHub =5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a...
CVE-2026-27885 Piwigo: SQL Injection in Activity.getList
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including...
CVE-2026-27833
Piwigo (web photo gallery) prior to version 16.3.0 exposes the pwg.history.search API without admin_only, allowing unauthenticated users to access the full browsing history of gallery visitors. This affects confidentiality of visitor history. The issue is resolved by upgrading to Piwigo 16.3.0, w...
CVE-2025-68152
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju...
