1164678 matches found
RHEL 10 : kernel (RHSA-2026:73788)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73788 advisory. A special build of the kernel packages for Red Hat Enterprise Linux for NVIDIA. For more details about the security issues, including the...
RHEL 8 : rsync (RHSA-2026:74095)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74095 advisory. The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because...
RHEL 9 : vim (RHSA-2026:72466)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72466 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted directo...
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.19 Update (Important) (RHSA-2026:73644)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73644 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...
RHEL 10 : expat (RHSA-2026:74001)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74001 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...
SUSE CVE-2026-85644
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV rather than SvROK. SvRV reads a union slot...
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...
GHSA-H3MG-XC3C-68PW ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...
SUSE CVE-2026-101910
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the BatchActivator.quote method in src/virtualenv/activation/batch/init.py, which previously returned its input string unchanged. When a virtualenv is created in a path containing cmd.exe operator characters such a...
GHSA-Q4XH-88C3-WMH7 vulnerabilities
Vulnerabilities for packages: apache-nifi, apache-tika-fips, wavefront-proxy, datahub-gms, cruise-control, nacos, ontop, apache-camel-karavan-devmode, sonarqube, apache-hop, flink-kubernetes-operator, strimzi-kafka-operator, request-9047-keycloak-fips, flink-kubernetes-operator-fips,...
GHSA-GX83-3VF8-GH7J vulnerabilities
Vulnerabilities for packages: apache-nifi, apache-tika-fips, wavefront-proxy, datahub-gms, cruise-control, nacos, ontop, apache-camel-karavan-devmode, sonarqube, apache-hop, flink-kubernetes-operator, strimzi-kafka-operator, request-9047-keycloak-fips, flink-kubernetes-operator-fips,...
CVE-2026-68497 vulnerabilities
Vulnerabilities for packages: apache-nifi, apache-tika-fips, wavefront-proxy, datahub-gms, cruise-control, nacos, ontop, apache-camel-karavan-devmode, sonarqube, apache-hop, flink-kubernetes-operator, strimzi-kafka-operator, request-9047-keycloak-fips, flink-kubernetes-operator-fips,...
GHSA-WJGM-6HV5-3CVF vulnerabilities
Vulnerabilities for packages: apache-nifi, apache-tika-fips, wavefront-proxy, datahub-gms, cruise-control, nacos, ontop, apache-camel-karavan-devmode, sonarqube, apache-hop, flink-kubernetes-operator, strimzi-kafka-operator, request-9047-keycloak-fips, flink-kubernetes-operator-fips,...
CVE-2026-19032 vulnerabilities
Vulnerabilities for packages: apache-nifi, apache-tika-fips, wavefront-proxy, datahub-gms, cruise-control, nacos, ontop, apache-camel-karavan-devmode, sonarqube, apache-hop, flink-kubernetes-operator, strimzi-kafka-operator, request-9047-keycloak-fips, flink-kubernetes-operator-fips,...
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: opentelemetry-go-instrumentation, percona-grafana, grafana-pyroscope-fips, harbor-registry-fips, datadog-agent-fips, caddy-fips, falcosidekick, grafana, opentofu-fips, pulumi-kubernetes-operator, fluent-bit-plugin-loki, harbor-registry, elastic-agent, tempo,...
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: harbor-registry, opentofu, tempo, aws-otel-collector, zot, caddy, kots, amazon-cloudwatch-agent, datadog-agent, distribution, grafana-alloy, grafana, loki, falcosidekick, fluent-bit-plugin-loki, mcp-grafana, grafana-mimir, grafana-pyroscope, pulumi-kubernetes-operato...
CVE-2026-49265
A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The "codechallengemethodplain" function uses Python's standard "==" operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based...
Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029
Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...
