MiracleLinux 9 : ipa-4.13.4-1.el9_8 (AXSA:2026-1928:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1928:05 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...

Oracle Linux 10 : ipa (ELSA-2026-72279)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72279 advisory. - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

Amazon Linux 2023 : environment-modules, environment-modules-compat (ALAS2023-2026-3135)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3135 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compgen -W, whichperforms a full unquoted-word expansion on its wordlist --...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

Important: environment-modules

Issue Overview: modulecomgenwordsandfiles fed untrusted text module names read off disk, LOADEDMODULES, MODULEPATH straight into compgen -W, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module...

SUSE CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

SUSE CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-24061

CVE-2026-24061 - GNU InetUtils telnetd 引数インジェクションによる認証回避 GNU InetUtils バージョン 1.9.3 から 2.7 は、telnetd サーバーにおけるリモート認証回避の脆弱性の影響を受けます。telnetd デーモンは、USER 環境変数を login1 プログラムにコマンドライン引数として渡す前に適切にサニタイズしません。telnet クライアントが -f root などのコマンドラインフラグを含む USER 環境変数を送信すると、telnetd はこのサニタイズされていない値をそのまま login...

freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

PT-2026-99898

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.16.2 SUSE Rancher Fleet versions prior to 0.15.7 SUSE Rancher Fleet versions prior to 0.14.11 SUSE Rancher Fleet versions prior to 0.13.16 SUSE Rancher Fleet versions prior to 0.12.20 Description A user...

PT-2026-99764

Name of the Vulnerable Software and Affected Versions Google fuse-archive versions prior to 1.24 Description An attacker can hijack the execution pathway by prepending a directory to the PATH environment variable or by writing a malicious binary to a writable directory that appears in the PATH...

Important: environment-modules

Issue Overview: modulecomgenwordsandfiles fed untrusted text module names read off disk, LOADEDMODULES, MODULEPATH straight into compgen -W, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module...

ipa security, bug fix, and enhancement update

4.13.4-1.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.13.4-1 - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

shellshock-cve-lab

Shellshock CVE-2014-6271 ラボ このリポジトリには、CVE-2014-6271 用の小さな CGI ラボが含まれています。GNU bash 4.2 をコンパイルし、 Python の RFC-3875 スタイルのサーバーを通じて CGI スクリプトを提供し、リクエストヘッダーを CGI 環境変数にマッピングします。 Sentinel は、このシナリオを 2026-08-27 にゼロから構築したサンドボックスラボとして再現しました。 これは意図的に脆弱性を含むラボです。隔離されたローカル環境またはサンドボックス 環境でのみ実行してください。 実行 docker...

CVE-2026-101043

A flaw was found in pnpm. This vulnerability can lead to information disclosure because proxy settings defined in workspace configuration files expand environment variable placeholders without proper restrictions. An attacker who convinces a user or automated system to run a command within a...

CVE-2026-101043

The pnpm package manager (versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 ) is vulnerable to environment variable exfiltration. The root cause is that pnpm-workspace.yaml files expand ${VAR} placeholders in httpProxy, httpsProxy, and noProxy settings without sufficient restrictions. An a...

EUVD-2026-87974

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101043: Insertion of Sensitive Information Into Sent Data

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...