30384 matches found
PT-2026-76697
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...
CVE-2026-19980: Improper Control of Generation of Code
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.updatelangs of the component Language Update. Performing ...
z3 z3-5.1.0
Z3 Z3 is a theorem prover from Microsoft Research. It is licensed under the MIT license. Windows binary distributions include C++ runtime redistributables If you are not familiar with Z3, you can start here. Pre-built binaries for stable and nightly releases are available here. Z3 can be built...
Smap v1.0.0-beta
nmap alternative powered by shodan.io Smap is a passive port scanner built with shodan.io's free API. It takes the same command line arguments as Nmap and produces the same output, which makes it a drop-in replacement for Nmap. Features Scans 200 hosts per second Doesn't require any account/api k...
Malicious code in fastly-vcl-language-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...
MAL-2026-14060 Malicious code in fastly-vcl-language-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...
MINI-2MP3-2VJ8-JPPR
Bulletin has no description...
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Quantized Vision-Language-Action VLA models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0%$, while hundreds of random flips are harmless. Across...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: kratos, ghaudit, kwok, polaris, sftpgo, terraform-provider-azurerm, terraform-provider-acme, nri-redis, knative-client, falcoctl, witness, step-kms-plugin, q, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, controller-gen, sqlexporter,...
GO-2026-5972 vulnerabilities
Vulnerabilities for packages: kratos, ghaudit, kwok, polaris, sftpgo, sbom-convert, terraform-provider-azurerm, terraform-provider-acme, nri-redis, knative-client, falcoctl, witness, step-kms-plugin, q, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, controller-gen...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: kratos, ghaudit, kwok, polaris, sftpgo, terraform-provider-azurerm, terraform-provider-acme, nri-redis, knative-client, falcoctl, witness, step-kms-plugin, q, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, controller-gen, sqlexporter,...
GO-2026-6088 vulnerabilities
Vulnerabilities for packages: kwok, polaris, sftpgo, sbom-convert, terraform-provider-azurerm, terraform-provider-acme, knative-client, falcoctl, witness, step-kms-plugin, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, sqlexporter, tekton-pipelines,...
CVE-2026-56859 vulnerabilities
Vulnerabilities for packages: kwok, polaris, sftpgo, sbom-convert, terraform-provider-azurerm, terraform-provider-acme, knative-client, falcoctl, witness, step-kms-plugin, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, sqlexporter, tekton-pipelines,...
CVE-2026-56860 vulnerabilities
Vulnerabilities for packages: kratos, ghaudit, kwok, polaris, sftpgo, sbom-convert, terraform-provider-azurerm, terraform-provider-acme, knative-client, falcoctl, witness, step-kms-plugin, q, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, controller-gen,...
GO-2026-6218 vulnerabilities
Vulnerabilities for packages: kratos, ghaudit, kwok, polaris, sftpgo, sbom-convert, terraform-provider-azurerm, terraform-provider-acme, knative-client, falcoctl, witness, step-kms-plugin, q, argocd-image-updater, mcp-grafana, kube-vip, rancher-system-upgrade-controller, controller-gen,...
CVE-2026-72816
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
Expression Language Injection
Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...
GO-2026-4803 vulnerabilities
Vulnerabilities for packages: minio...
GO-2026-4603 vulnerabilities
Vulnerabilities for packages: cert-manager-google-cas-issuer, kubernetes-dashboard-fips, tempo, rke2-cloud-provider-fips, cerbos-fips, nvidia-container-toolkit, flux-source-controller, rancher-fleet-fips, terraform, terraform-provider-azurerm-fips, opencost, external-dns-fips, mattermost-fips,...