137103 matches found
ROOT-APP-NPM-CVE-2026-26278 CVE-2026-26278 in fast-xml-parser - Patched by Root
Root has patched CVE-2026-26278 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...
How Developers Prevent Production Risk at the Source
Fixing security vulnerabilities in code takes seconds, while patching in production creates high operational costs and risk. Discover how empowering developers as your first line of defense eliminates exposure across every phase of your software pipeline...
SUSE CVE-2026-74355
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...
PT-2026-85258
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...
Linux Distros Unpatched Vulnerability : CVE-2026-65139
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues in unsafe operation/queries to the slurmdbd CVE-2026-65139 Note that Nessus relies on the...
Linux Distros Unpatched Vulnerability : CVE-2026-65109
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix...
PT-2026-85257
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...
PT-2026-89118
Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...
Linux Distros Unpatched Vulnerability : CVE-2026-80229
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When performing transfers via libcurl's multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations...
nodejs:24 security update
nodejs 1:24.18.0-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223388 RHEL-223907 RHEL-223792 1:24.18.0-3 - Backport patch update sqlite to 3.53.4 Fixes: CVE-2026-11824, CVE-2026-11822...
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...
GHSA-MC5Q-6HPJ-RP7J Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...
GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...
CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1
CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...