10213 matches found
CVE-2026-50190
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...
CVE-2026-55564
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...
CVE-2026-48711
SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...
CVE-2026-59893 vulnerabilities
Vulnerabilities for packages: mlflow, mycli, airflow...
CVE-2026-50645 vulnerabilities
Vulnerabilities for packages: apache-tika-fips, apache-tika, wso2is...
CVE-2026-45699
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-47192
kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...
CVE-2026-47766
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...
GO-2024-3269 vulnerabilities
Vulnerabilities for packages: gh...
GO-2026-6005 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, gitlab-operator-fips, gitlab-operator, tigera-operator, datadog-agent, tigera-operator-fips...
GO-2026-6007 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, gitlab-operator-fips, gitlab-operator, tigera-operator, datadog-agent, tigera-operator-fips...
GO-2026-5597 vulnerabilities
Vulnerabilities for packages: rclone-fips, rancher-fleet, grafana-fips, cerbos-fips, flux, kyverno-fips, chainloop-cli-fips, upwind-agent, external-secrets-operator-fips, terragrunt-fips, flux-fips, packer-fips, gitaly, telegraf, syft, terragrunt, argo-cd, rclone, seaweedfs-rocksdb, skaffold-fips...
GO-2024-3296 vulnerabilities
Vulnerabilities for packages: gh...
CVE-2026-72898 vulnerabilities
Vulnerabilities for packages: metabase...
Improper Encoding or Escaping of Output
Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper escaping in the getEscapeFunction function. An attacker can access sensitive home-directory information and potentially alter the target...
Command Injection
Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Command Injection in the escape and escapeAll functions when used on Unix systems with the shell explicitly configured to Zsh, or when the default shell is Zsh. An attacker can obtain lists of...
GHSA-4H4R-Q9XG-GFMM vulnerabilities
Vulnerabilities for packages: libssh...
CVE-2026-73412
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...
