CVE-2026-50180

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses...

ROS-20260710-73-0004

The vulnerability of the url.Parse function in the host/authority component of the Go programming language is related to improper syntax validation of input. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

RHEL 9 : buildah (RHSA-2026:37410)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37410 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

RockyLinux 10 : nodejs24 (RLSA-2026:35841)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

EulerOS 2.0 SP12 : busybox (EulerOS-SA-2026-2521)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request- target path/query, allowing the request line ...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-2523)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but...

FreeBSD : Apache HttpClient -- misinterpret malformed authority component (fa0c03dd-7c3a-11f1-8dc2-dca632daf43b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fa0c03dd-7c3a-11f1-8dc2-dca632daf43b advisory. Apache Software Foundation reports: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can...

PT-2026-57220

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description An unauthenticated remote attacker can bypass API-key authentication by sending a Host: localhost header, as the system incorrectly relies on the client-controlled Host header to determine if a reque...

EulerOS 2.0 SP12 : systemd (EulerOS-SA-2026-2632)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the...

Linux Distros Unpatched Vulnerability : CVE-2026-50812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can...

OpenSSH < 10.4 Multiple Vulnerabilities

The version of OpenSSH installed on the remote host is prior to 10.4. It is, therefore, affected by multiple vulnerabilities, including: - ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side...

OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect

Summary The restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. Details In the current project, the referrer header value is used for subsequent redirects, so there is currently a validation for this redirect value. The current validation logic...

MAL-2026-10105 Malicious code in pxpure8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a40ae433e9fa90bfbb449d343c281375329a44c0dacf080a91a0c1717579b679 The package's main entry pure.js consists of a single behavior: it creates a element pointing at https://cdn.jsdelivr.net/npm/px8my/px.js no version...

Malicious code in security-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...

MAL-2026-10107 Malicious code in security-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...

Malicious code in optimize-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b77c2c0dab050d3a675407d74b649c73bfc107da05191cf041fb66e0346073a package.json declares optimize-regex as a dependency and devDependency of itself, resolved via a plain-HTTP tarball URL at...

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

Summary Two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate issuance time — only at poll time. 1. Blocklist not enforced at sign / re-enroll time...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient enforcement of host revocation and operator status during certificate issuance and renewal processes. An attacker can regain valid certificates for blocked or offboarded hosts by re-enrolling or...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient enforcement of host revocation and operator status during certificate issuance and renewal processes. An attacker can regain valid certificates for blocked or offboarded hosts by re-enrolling or...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient enforcement of host revocation and operator status during certificate issuance and renewal processes. An attacker can regain valid certificates for blocked or offboarded hosts by re-enrolling or...