5662 matches found
BIT-AUTHENTIK-2023-36456 Authentik lacks Proxy IP headers validation
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...
[SECURITY] Fedora 42 Update: perl-5.40.4-520.fc42
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...
Fedora 42 : moby-engine (2026-49fd0d9636)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-49fd0d9636 advisory. - Update to release v29.4.0 - Resolves: rhbz2455894 - Resolves CVE-2026-34986: rhbz2455665 - Upstream new features and fixes Tenable has extracted the...
nginx 0.6.27 < 1.28.3 / 1.29.x < 1.29.7 SMTP Upstream Injection
The installed version of nginx is 0.6.27 prior to 1.28.3, or 1.29.x prior to 1.29.7. It is, therefore, affected by the following issue: - NGINX Plus and NGINX Open Source have a vulnerability in the ngxmailsmtpmodule module due to the improper handling of CRLF sequences in DNS responses. This...
CVE-2026-6359
An use after free flaw was found in the Video component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=490251701...
CVE-2026-6297
An use after free flaw was found in the Proxy component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=493628982...
CVE-2026-6301
A type confusion flaw was found in the Turbofan component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495273999...
nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security TLS servers, An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response...
NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
A flaw was found in NGINX Plus and NGINX Open Source, specifically within the ngxmailsmtpmodule. This vulnerability allows an attacker-controlled DNS Domain Name System server to inject arbitrary headers into SMTP Simple Mail Transfer Protocol upstream requests. This is due to the improper handli...
OAuth2 Proxy 安全漏洞
OAuth2 Proxy is a reverse proxy that can provide authentication for interactions with Google, Github, or other providers. Versions of OAuth2 Proxy prior to 7.15.2 contained a security vulnerability. This vulnerability stemmed from a configuration-related authentication bypass, which could allow...
bind security update
9.16.23-34.0.1.el97.2 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-34.2 - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 32:9.16.23-34.1 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 - Replace downstream fixes...
Oracle Linux 10 : nodejs24 (ELSA-2026-7675)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7675 advisory. 1:24.14.1-2.0.2 - Rebuild to correct NVR 1:24.14.1-2.0.1 - Update upstream references Tenable has extracted the preceding description block directly...
CVE-2026-5918
An inappropriate implementation flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=490139441...
CVE-2026-5913
An out of bounds read flaw was found in the Blink component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=487195286...
CVE-2026-5908
An integer overflow flaw was found in the Media component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=485115554...
CVE-2026-5904
An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=483851888...
CVE-2026-5905
An incorrect security ui flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=483899628...
CVE-2026-5900
A policy bypass flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=475265304...