Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-094eb13bb1 advisory. nginx-mod-fancyindex: - Rebuild for 1.30.1 nginx-mod-headers-more: - Rebuild for 1.30.1 nginx-mod-naxsi: - Rebuild for 1.30.1 nginx-mod-js-challenge...

CVE-2026-38728

An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...

Siemens Teamcenter PDF.js Arbitrary Code Execution (SSA-827383)

The version of Siemens Teamcenter installed on the remote host is affected by a vulnerability: - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. CVE-2024-4367 Note that Nessus has not tested for this issue but has...

CVE-2026-44670

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...

Cross-site Scripting (XSS)

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the fides.js script's override mechanism for the banner description field when HTML-formatted descriptions are enabled. An attacker can...

CVE-2026-44482

CVE-2026-44482 affects the SoundCloud Client app (soundcloud-rpc) built on Electron. Before 0.1.8, a track title could contain an HTML payload that, via the preload API window.soundcloudAPI.sendTrackUpdate and IPC to the Electron main process, is rendered as raw HTML in privileged views with Node...

WS-2019-0477

Slush-fullstack-framework v0.9.2 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

WS-2019-0456

Ng-ui-library v1.0.987 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...

WS-2019-0457

Ngx-context-menu v0.0.26 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...

WS-2019-0437

All versions of js-base64-int contains malicious code. The package uploaded system information such as OS and hostname to a remote server...

WS-2019-0438

All versions of js-regular contains malicious code. The package uploaded system information such as OS and hostname to a remote server...

WS-2019-0432

Grunt-radical, version 0.0.14 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...

WS-2019-0413

crpyto-js was designed to find and exfiltrate cryptocurrency wallets...

WS-2019-0406

cage-js contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script...

WS-2019-0389

Angular-location-update, version 0.0.3 contains malicious code that gets executed in the browser and enumerates password, cvc and cardnumber fields from forms and sends the extracted values to "hps://js-metrics.com/minjs.php?pl="...

WS-2019-0386

@fangrong/xoc version 1.0.6 contains malicious code which steals sensitive information such as cardnumbers and passwords from forms in the browser and send them to "hps://js-metrics.com/minjs.php?pl="...

WS-2018-0625

The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue...

WS-2020-0050

1337qq-js is a malicious package, on Unix systems the package allows remote attackers to disclose sensitive information...

WS-2020-0010

All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...

WS-2019-0341

Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...