10208 matches found
CVE-2026-16728 vulnerabilities
Vulnerabilities for packages: langfuse-fips, actions-runner, saf, vitess, renovate, npm, kibana, pulumi, code-server, prism, langfuse, pelias-api...
GHSA-V3R7-H72X-CJCM vulnerabilities
Vulnerabilities for packages: langfuse-fips, actions-runner, saf, vitess, renovate, npm, kibana, pulumi, code-server, prism, langfuse, pelias-api...
GHSA-8359-H9FX-J6V9 vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-55403 vulnerabilities
Vulnerabilities for packages: label-studio...
GHSA-RFR2-MQ9M-X2QX vulnerabilities
Vulnerabilities for packages: label-studio...
CVE-2026-67355 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-MJRX-74JH-7XGW vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-70367
A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...
CVE-2026-68744
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
CVE-2022-21680 vulnerabilities
Vulnerabilities for packages: arangodb...
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: superset, airflow, kserve, kubeflow-pipelines, py3-cassandra-medusa, mlflow...
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: openstack-keystone-2026.1, kserve, kubeflow-pipelines, py3-cassandra-medusa, duplicity, airflow, authentik-fips, openstack-keystone-2025.1, authentik, dbt-bigquery, superset, lmcache-cuda-12.8, wazuh-manager, wazuh-manager-fips, datahub-ingestion, localstack,...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
SUSE CVE-2026-55244
ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROMPY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval, while run and eval in asteval/asteval.py catch Exception rather...
SUSE CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
CVE-2026-53669 vulnerabilities
Vulnerabilities for packages: vitess, keycloak...