CVE-2026-10291

A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient...

Alibaba Cloud Linux 3 : 0001: git-lfs (ALINUX3-SA-2026:0001)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0001 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-26625: Git LFS is a Git extension for...

PT-2025-42616

Name of the Vulnerable Software and Affected Versions Git LFS versions 0.5.2 through 3.7.0 Description Git LFS commands, specifically git lfs checkout and git lfs pull, may write to files outside the intended Git working tree if symbolic or hard links are present that conflict with paths tracked ...

[SECURITY] [DLA 4267-1] gnutls28 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4267-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk August 09, 2025 https://wiki.debian.org/LTS -...

PT-2024-39592

Name of the Vulnerable Software and Affected Versions ThingsBoard versions up to 3.7.0 Description A vulnerability has been found in the HTTP RPC API component of ThingsBoard, which can lead to resource consumption. The attack can be launched remotely, but the complexity of an attack is rather hi...

XML External Entity (XXE) Injection

Overview com.twelvemonkeys.imageio:imageio-metadata is an ImageIO metadata module. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are abl...

PT-2021-14687 · Jenkins · Jenkins Config File Provider Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Config File Provider Plugin versions 3.7.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID. This issue arises because th...