21961 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-16424
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially...
SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:3221-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3221-1 advisory. This update for MozillaFirefox fixes the following issue: - Firefox Extended Support Release 140.13.0 ESR MFSA...
SUSE SLES12 Security Update : net-tools (SUSE-SU-2026:3222-1)
The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3222-1 advisory. - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted the preceding description block directly from the...
openSUSE 16 Security Update : net-tools (openSUSE-SU-2026:21429-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21429-1 advisory. This update for net-tools fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences bsc1254323. Tenable has extracted...
Linux Distros Unpatched Vulnerability : CVE-2026-16352
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.1...
Linux Distros Unpatched Vulnerability : CVE-2026-16416
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network...
Linux Distros Unpatched Vulnerability : CVE-2026-16356
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.1...
Linux Distros Unpatched Vulnerability : CVE-2026-16804
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a...
Linux Distros Unpatched Vulnerability : CVE-2026-55708
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree fo...
GHSA-FWJX-9P69-H25H Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...
GHSA-Q53C-4PRM-W95Q Shescape: Home-directory disclosure in assignment context on Unix with Dash
Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...
Shescape: Home-directory disclosure in assignment context on Unix with Dash
Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...
OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...
GHSA-95CV-R8X4-VH75 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...
SUSE CVE-2026-16804
Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-16806
Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-16807
Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
