133394 matches found
RHSA-2026:54835 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root
Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...
BIT-SEAWEEDFS-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
BIT-NODE-MIN-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
BIT-NODE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
BIT-GHOST-2026-70588 Ghost: Cross-Site Scripting in Universal Import
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...
BIT-AIRFLOW-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...
CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...
CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
sccache-0.17.0~1-2.1 on GA media (moderate)
sccache-0.17.01-2.1 on GA media Announcement ID: openSUSE-SU-2026:11527-1 Rating: moderate Cross-References: CVE-2026-25541 CVE-2026-66746 CVE-2026-66754 CVE-2026-67181 CVE-2026-67182 CVSS scores: CVE-2026-25541 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25541 SUSE : 8.7...
EUVD-2026-60537
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
MiracleLinux 9 : hplip-3.21.2-6.el9_8.5.ML.1 (AXSA:2026-1545:04)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1545:04 advisory. HPLIP: Incomplete Fix for CVE-2026-8631 CVE-2026-14544 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...
OPENSUSE-SU-2026:11529-1 forgejo-cli-0.6.0-2.1 on GA media
These are all security issues fixed in the forgejo-cli-0.6.0-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-67967
CVE-2026-67967 is a buffer overflow (CWE-121) and command injection (CWE-78) in the /goform/module API of Tenda W20E V5.0 firmware V16.01.0.6(2782). The vendor's prior fix (CVE-2025-44867, CVE-2026-36819) left sibling handlers vulnerable: setFixTools.hostName filters only ;, &, | before popen()-e...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-022345)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022345 advisory. An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size validation check lsize + 8 size, but it do...
MINI-2X84-H83P-C75C
Bulletin has no description...
MINI-J3JQ-W7RX-5XFR
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-4923 CVE-2026-4923 in path-to-regexp - Patched by Root
Root has patched CVE-2026-4923 in the path-to-regexp package for Root:npm. Multiple fixed versions available...
CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...