UBUNTU-CVE-2026-0846

A vulnerability in the filestring function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by...

CVE-2026-3638

CVE-2026-3638 : Multiple sources (NVD, Red Hat, ENISA, CVE List) describe an improper access control flaw in Devolutions Server up to version 2025.3.11.0. A low-privileged, authenticated user can restore deleted users and roles via crafted API requests on the user/role restore endpoints. Document...

CVE-2026-3638

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the deprecated host-callback APIs kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services. An attacker can gain unauthorized read access to Ingresses, Namespaces, and Services resources across al...

Budibase 注入漏洞

Budibase is an open-source low-code platform developed by Budibase in the UK. It allows for the creation of internal applications, workflows, and management panels within minutes. Budibase versions 3.31.4 and earlier have a injection vulnerability. This vulnerability stems from the authorized...

PT-2026-24144

Name of the Vulnerable Software and Affected Versions Kubewarden versions prior to 1.33.0 Description Kubewarden is a policy engine for Kubernetes. An attacker with privileged "AdmissionPolicy" create permissions could leverage three deprecated host-callback APIs: kubernetes/ingresses,...

Access Control Bypass

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Access Control Bypass in the middleware that processes requests to /api/v1 endpoints. An attacker can gain unauthorized access to internal administration APIs by spoofing the x-request-from header as...

Fedora 43 : coturn (2026-8cb5571ddc)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8cb5571ddc advisory. Coturn 4.9.0 - Multiple security fixes - Fix to Web Admin password check - Cleanup of deprecated OpenSSL APIs - Fix for CVE-2026-27624: Bypass...

Vulnerabilities fixed in Cisco Secure Firewall systems

Cisco has fixed several vulnerabilities in Cisco Secure Firewall including ASA and FTD software. The vulnerabilities include SQL injection, privilege escalation, denial-of-service, cross-site scripting, and improper management of entries in various Cisco Secure Firewall components. Authenticated...

CVE-2026-0847

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...

CVE-2026-0847

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...

PT-2026-23094

Name of the Vulnerable Software and Affected Versions Immutable.js versions prior to 3.8.3 Immutable.js versions prior to 4.3.7 Immutable.js versions prior to 5.1.5 Description A Prototype Pollution issue exists in Immutable.js through versions prior to 3.8.3, 4.3.7, and 5.1.5, specifically withi...

Malicious Package

Overview cloud-apis is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-1193 Malicious code in cloud-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d014766db57fb4d6cceffc9e45821e7c14135a358abdc4db25a0310538266699 The package cloud-apis was found to contain malicious code. Source: ghsa-malware 34de661e0892c5941755ca8d9db5fbcd64da940f5b21755f4b20862a758fe769 Any...

MAL-2026-1200 Malicious code in mongoose-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8158b4b1cc5affba57a810926c5765a7af056b7e89cf2ce07da0615144bac920 The package mongoose-apis was found to contain malicious code. Source: ghsa-malware b967e890598bf7e59192b0eb97d1c9ef5d00f60f2730955e684e67b3acfe888f...

Malicious code in mongoose-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8158b4b1cc5affba57a810926c5765a7af056b7e89cf2ce07da0615144bac920 The package mongoose-apis was found to contain malicious code. Source: ghsa-malware b967e890598bf7e59192b0eb97d1c9ef5d00f60f2730955e684e67b3acfe888f...

Malicious code in cloud-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d014766db57fb4d6cceffc9e45821e7c14135a358abdc4db25a0310538266699 The package cloud-apis was found to contain malicious code. Source: ghsa-malware 34de661e0892c5941755ca8d9db5fbcd64da940f5b21755f4b20862a758fe769 Any...

Malicious Package

Overview mongoose-apis is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-27973

Audiobookshelf (mobile app) prior to 0.12.0-beta is affected by a stored cross-site scripting (XSS) vulnerability via malicious library metadata that allows arbitrary JavaScript execution in victim users’ browsers/WebViews. According to the advisory, attackers with library modification privileges...

Audiobookshelf 跨站脚本漏洞

Audiobookshelf is an open-source, self-hosted server for audio books and podcasts. Versions of Audiobookshelf prior to 0.12.0-beta contained a cross-site scripting vulnerability. This vulnerability was caused by malicious library metadata, which led to cross-site scripting attacks. Such attacks...