JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

CVE-2026-57998

better-npm-audit (npm package) through 3.11.0 and the 4.0.0-rc.2 prerelease is vulnerable to OS command injection via the --registry option. The user-supplied registry value is interpolated into a command string in src/handlers/handleInput.ts without validation or quoting, then passed to child_pr...

EUVD-2026-64261

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

GHSA-7236-3392-C5C6 vulnerabilities

Vulnerabilities for packages: kubescape, kaniko, conftest, scorecard, guac, podman...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2025-62307

HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...

EUVD-2025-210751

HCL IntelliOps Event Management IEM is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response...

Jenkin Audit Trail <=3.2 - Cross-Site Scripting

Jenkins Audit Trail 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2140 info: name: Jenkin Audit Trail =3.3 which includes a fix for this vulnerability. reference: -...

CVE-2026-74512

A flaw was found in the Linux kernel. During the deletion of audit rules, the auditdelrule function prematurely frees a resource while other kernel functions can still access it. This creates a use-after-free vulnerability, which a local attacker could potentially exploit to cause system...

CVE-2026-44256

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

MINI-2C49-X6GV-455H

Bulletin has no description...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...

EUVD-2026-62575

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

MINI-WX87-H5FJ-M3JW

Bulletin has no description...

MINI-XGGQ-H9Q9-QP8G

Bulletin has no description...

MINI-Q3MC-H86C-96V3

Bulletin has no description...

MINI-Q428-8WMG-PVVR

Bulletin has no description...

MINI-R7J4-3356-J68Q

Bulletin has no description...

CVE-2026-49426

FreeBSD's kernel passed an internal setup function's return value instead of the actual syscall result to AUDIT_SYSCALL_EXIT(), so audit records for ptrace(PT_SC_REMOTE) calls incorrectly show success for failed operations. Affects all supported FreeBSD versions; fixed in stable/14, stable/15, an...