GHSA-X3G7-QRWC-F6C5 Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

GHSA-6WVW-VRW4-363W node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

Exploit for CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Pr...

CVE-2026-63387

libevent <2.1.13 and

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

OESA-2026-3415 gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...

GHSA-VV88-699V-W5RH vulnerabilities

Vulnerabilities for packages: wget...

GO-2026-6189 vulnerabilities

Vulnerabilities for packages: telegraf...

GO-2026-6197 vulnerabilities

Vulnerabilities for packages: telegraf...

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...

FFmpeg RIST Protocol Heap Buffer Overflow

FFmpeg versions 4.4 through 9.0 contain a heap buffer overflow vulnerability in the RIST protocol reader when built with librist support. A remote unauthenticated attacker can send oversized RIST payloads to an affected async:rist:// receiver, causing attacker-controlled data to be written beyond...

VulnCheck KEV: CVE-2015-5287

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool ABRT before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump...

PT-2026-79197

Name of the Vulnerable Software and Affected Versions Microsoft Fabric affected versions not specified Description A relative path traversal issue exists that allows an authorized attacker to elevate privileges over a network. Path traversal is a technique used to access files and directories tha...

JetBrains YouTrack < 2026.2.17917 Missing Authorization (CVE-2026-75051)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.17917. It is, therefore, affected by a missing authorization vulnerability: - Unauthorised project transfer between organisations was possible. CVE-2026-75051 Note that Nessus has not tested for this issue but has...

PT-2026-79189

Name of the Vulnerable Software and Affected Versions Windows Remote Help Defense affected versions not specified Description An uncontrolled search path element allows an authorized attacker to perform local spoofing. This occurs when the application searches for a file in a directory that can b...