Python < 3.10.22 / 3.11.x < 3.11.17 / 3.12.x < 3.12.15 / 3.13.x < 3.13.16 / 3.14.x < 3.14.0b1 Link Following

The version of Python installed on the remote Windows host is prior to 3.10.22, or is 3.11.x prior to 3.11.17, or 3.12.x prior to 3.12.15, or 3.13.x prior to 3.13.16, or 3.14.x prior to 3.14.0b1. It is, therefore, affected by a link following vulnerability. In CPython 3.13 and earlier, the tarfil...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4589-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4589-1 advisory. - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. -...

CVE-2026-87660

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...

PT-2026-95635

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A timing issue, known as a symlink race condition, exists during privileged file operations such as changing file ownership or permissions. A local attacker can manipulate directory...

CVE-2026-76555

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-80179

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-77893

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: Write access is restored before closing files opened by openexec. bmregisterwrite opens an executable file using openexec, which internally calls doopenexecat and denies write access to the file to prevent modificatio...

CVE-2026-82049: Improper Link Resolution Before File Access

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

PT-2026-80423

Unsafe file permission restoration from metadata in github.com/rclone/rclone...

Unity Linux 20.1070e Security Update: nfs-utils (UTSA-2026-099540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099540 advisory. A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned t...

GO-2026-5658 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2023-2070 vulnerabilities

Vulnerabilities for packages: croc...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, kserve-modelmesh, jmeter, kayenta-fips, floci, wavefront-proxy, druid, logstash-fips, logstash, kayenta, wazuh-indexer, conductor, thingsboard, geoserver, pinot-fips, traccar-fips, airbyte-server, dependency-track-apiserver, nacos-docker,...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

Linux Distros Unpatched Vulnerability : CVE-2026-52791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.18 contains a security vulnerability. This vulnerability arises from an oversight in the handling of chown/chgrp operations when mounting SMB3 POSIX extensions. As a result, modifications to ownership and group are not properly checked, leading to the neglect of file...