50357 matches found
PT-2026-66407
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Permission Model enforcement allows the trace events.createTracing.enable function to write trace logs outside the boundaries defined by the...
PT-2026-66590
Name of the Vulnerable Software and Affected Versions dnsmgr versions prior to 2.16 Description A local attacker can execute arbitrary code through the ping function located in the CheckUils.php file. Recommendations Update dnsmgr to version 2.16 or later. As a temporary workaround, restrict acce...
Linux Distros Unpatched Vulnerability : CVE-2026-56847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to...
PT-2026-66445
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
PT-2026-66448
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
PT-2026-66408
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Node.js HTTPS Agent connection reuse mechanism can lead to PFX object-array key collisions. This issue allows mutual TLS mTLS client identities to be...
CVE-2026-35847
The dnsmgr software (versions v.2.15 and before ) contains a vulnerability that allows a local attacker to execute arbitrary code . The root cause is identified as the ping() function located within the CheckUils.php file. Impacted users are advised to update to version 2.16 or later . As a tempo...
PT-2026-66634
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages...
MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)
The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...
Fedora 44 : proftpd (2026-2994824419)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2994824419 advisory. This update adds a new module, modprocfs, which is enabled by default. It addressses CVE-2026-35025 ACL bypass via /proc/self/root path prefix, by disallowin...
CVE-2026-35847
An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...
CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.2-2.3.hum1 noarch nodejs22-devel-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.2-2.3.hum1 noarch...
nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks
A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...
CVE-2026-67437
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...
CVE-2026-67432
creationtimestamp| type| source ---|---|--- 2026-07-29 20:57:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsstprxqw2i 2026-07-29 21:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrsszcbcnl22 2026-07-30 16:35:23+00:00| published-proof-of-concept|...
CVE-2026-6267
creationtimestamp| type| source ---|---|--- 2026-07-29 20:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssq4z4eg24 2026-07-29 21:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrssz3rn6z23 2026-07-30 03:11:06+00:00| seen|...
CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...
K000162672: Apache HTTP Server vulnerability CVE-2026-34356
Security Advisory Description Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...