56 matches found
GHSA-HX6P-XPX3-JVVV vulnerabilities
Vulnerabilities for packages: wasmcloud, yara-x, wizer, zed...
CVE-2026-6842
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions 0777 instead of 0700 for the /.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or...
CVE-2026-35251
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...
CVE-2026-35248
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...
CVE-2026-35250
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...
GHSA-67JX-R9PV-98RJ vulnerabilities
Vulnerabilities for packages: traefik-fips, traefik...
GHSA-56P5-8MHR-2FPH vulnerabilities
Vulnerabilities for packages: kibana...
CVE-2026-34829
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENTLENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfe...
GHSA-5239-WWWM-4PMQ vulnerabilities
Vulnerabilities for packages: localstack, datadog-agent-fips, pypy-3.10, airflow-core, apache-beam-python-3.12-sdk, label-studio, datadog-agent, mycli, litellm, az, openstack-kolla-toolbox-2025.2-fips, neuvector-manager, wazuh-manager, kubeflow-katib, open-webui, ggshield, azure-functions-host,...
GHSA-H6R3-P5GV-5QGC vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
CVE-2026-33058
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51...
GHSA-JMR7-XGP7-CMFJ vulnerabilities
Vulnerabilities for packages: tileserver-gl, prism, kubeflow-pipelines, jitsucom-jitsu, renovate, saf...
CVE-2026-0810
A flaw was found in gix-date. The gixdate::parse::TimeBuf::asstr function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed...
GHSA-5GVR-285Q-PWC3 vulnerabilities
Vulnerabilities for packages: linux-vmware-generic, linux-qemu-melange, linux-gcp-generic, linux-aws-generic, linux-azure, linux-azure-generic, linux-gcp, linux-vmware, linux-qemu, linux-qemu-rc, linux-aws...
CVE-2026-22690
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be...
CVE-2023-54068
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fswaitonpagewriteback in f2fswriterawpages BUGON will be triggered when writing files concurrently, because the same page is writtenback multiple times. 1597 void folioendwritebackstruct folio folio...
CVE-2025-59935
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch...
CVE-2025-65431
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...
GHSA-4QG8-FJ49-PXJH vulnerabilities
Vulnerabilities for packages: tkn, docker-cli-buildx, gh, kyverno, tflint, spire-server, skaffold, vexctl, flux-source-controller, falcoctl, ko, policy-controller, sigstore-scaffolding, zarf, cosign, witness, gitsign, tekton-chains, kubescape, zot, neuvector-sigstore-interface, teleport, aactl,...