apko has a path traversal in apko dirFS which allows filesystem writes outside base

A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatted repository could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink...

PT-2026-5718

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.20.0 through 1.39.0 Description The OpenTelemetry Go SDK versions 1.20.0 through 1.39.0 are susceptible to a path hijacking issue on macOS/Darwin systems. The resource detection code in sdk/resource/host id.go...

PT-2026-2733

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A flaw in Windows HTTP.sys related to improper access control can allow an authorized attacker to elevate privileges over a network. This issue can be exploited remotely. The...

EUVD-2026-1842

A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading t...

Fedora 43 : suricata (2025-a366512b23)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-a366512b23 advisory. Upstream security/bugfix release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

xorg-x11-server update

1.20.11-32 - CVE fix for: CVE-2025-62229 RHEL-119961, CVE-2025-62230 RHEL-120032, CVE-2025-62231 RHEL-125001...

BIT-MINIO-2025-62506 MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS Security Token Service accounts with restricted session policies to bypass their inline policy restrictions when performin...

EUVD-2021-25585

Malware in sbrugna...

EUVD-2019-16836

Malware in sbrugna...

EUVD-2024-38298

Malicious code in bioql PyPI...

EUVD-2025-23570

Malicious code in bioql PyPI...

EUVD-2025-27258

Malicious code in bioql PyPI...

CVE-2025-61666 Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File

Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file syste...

Security Bulletin: Due to use of Apache Kafka, IBM Operations Analytics - Log Analysis is vulnerable to RCE/Denial of Service attack.

Summary Apache Kafka is used by IBM Operations Analytics - Log Analysis as part of Logstash data distribution capabilities. CVE-2025-27819. Vulnerability Details CVEID:CVE-2025-27819 DESCRIPTION: In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule...

CVE-2025-38666 net: appletalk: Fix use-after-free in AARP proxy probe

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine aarpproxyprobenetwork sends a probe, releases the aarplock, sleeps, then re-acquires the lock. During that window an expire timer thread...

Important: Red Hat Security Advisory: Red Hat build of Tempo 3.6.1 release

Red Hat build of Tempo 3.6.1 has been released This release of the Red Hat build of Tempo provides a CVE fix. Breaking changes: Nothing Deprecations: Nothing Technology Preview features: Nothing Enhancements: Nothing Bug fixes: Nothing Known issues: Nothing...

CVE-2024-56159

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible...

CVE-2021-29542

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow by passing crafted inputs to tf.rawops.StringNGrams. This is because the...

CVE-2021-29576

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPool3DGradGrad is vulnerable to a heap buffer overflow. The...

CVE-2021-29529

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...