fscan v2.2.1

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370

Fleet (open-source device management platform built on osquery) versions up to 4.84.1 contained an ORDER BY oracle in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts). An unvalidated order_key parameter allowed Observer-level users to binary-search long-lived enrollment secr...

CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Malicious code in octopus-action (npm)

Source: amazon-inspector 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2 The package declares a preinstall lifecycle script node index.js that runs automatically on npm install. index.js collects the installer's hostname, OS username, home directory, configured DNS servers, packa...

Malicious code in analytics-v2 (npm)

Source: amazon-inspector a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982 On npm install, the package's preinstall hook executes index.js which harvests host and user identity data os.hostname, os.platform, os.arch, os.userInfo including username/uid/gid/shell, homedir, cwd and...

CVE-2026-54614 DebugKit: MailPreview contains unsafe reflection

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

GHSA-3P27-QVP9-27QF Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

GHSA-MV8M-V9V6-5F94 kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

CVE-2026-54548

kas is a setup tool for bitbake-based projects. Prior to version 5.4 , when internal SSH key setup is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no user-specific SSH configuration exists, the function ssh_no_host_key_check() in kas/libcmds.py creates ~/.ssh/config with a global Hos...

EUVD-2026-66560

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...