45636 matches found
CVE-2026-58075
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally...
CVE-2026-64633
A vulnerability allowing remote unauthenticated code execution on the agent host...
GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
CVE-2026-24077
CVE-2026-24077 is described as an Information Disclosure vulnerability in Qualcomm WLAN Host related to processing wireless network channel switch information with improperly formatted length fields. The connected records (CVE-List and CVE enrichment) reference this as an Integer Underflow in the...
CVE-2026-24076 Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory Corruption when processing registry values with incorrect types using a direct query method...
MAL-2026-12016 Malicious code in @keyv/memcache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 738202807ef51e0d987243e641bb2e97a2f4535bed388d631d80ead963a82b2f Package @keyv/[email protected] is a Keyv storage adapter for Memcache. No install-time lifecycle scripts, network exfiltration, credential access,...
Malicious code in launchdarkly-ai-server-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...
MAL-2026-11519 Malicious code in launchdarkly-ai-server-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
CVE-2026-17614
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
EUVD-2026-52490
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the request URI handling. An attacker can access resources on hosts that should have been excluded by bypassing host-based access controls through manipulation of noncanonical...
Linux Distros Unpatched Vulnerability : CVE-2026-18739
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application...
MiracleLinux 8 : yelp-3.28.1-3.el8_10.2 (AXSA:2026-1429:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1429:01 advisory. yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications CVE-2026-13601 Tenable has extracted...
Linux Distros Unpatched Vulnerability : CVE-2026-47781
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...
Linux Distros Unpatched Vulnerability : CVE-2026-69246
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-42169
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading t...
Linux Distros Unpatched Vulnerability : CVE-2026-70367
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Server-Side Request Forgery SSRF bypass vulnerability exists in stunnel 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypas...
SUSE CVE-2026-18446
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...