14057 matches found
Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774859936)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774859936 advisory. - Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security...
Rocky Linux 9 [CIQ] Security Update: python3-jinja2 (crlsa-2025_0667)
The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20250667 advisory. jinja2: Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326 Tenable has extracted the preceding description block directly from...
PT-2026-105796
Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface eval handler. The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario DEB...
GHSA-F596-WHHP-79R4 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers. Patches This vulnerability is...
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers. Patches This vulnerability is...
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...
NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method vulnerability discovered by ? in WordPress Npm axios versions = 0.27.2, 0.34.0...
EUVD-2026-88371
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method...
GHSA-9FR6-4GFG-395G Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...
CVE-2026-103237
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
CVE-2026-103237: Authorization Bypass Through User-Controlled Key
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1777883924)
The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1777883924 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...
Linux Distros Unpatched Vulnerability : CVE-2026-101902
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit...
SUSE CVE-2026-101902
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...
NPM: undici vulnerable to caching and replay of unsafe HTTP method responses
NPM: undici vulnerable to caching and replay of unsafe HTTP method responses vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...
N-able N-central CVE-2026-86218 Detect
Detects N-able N-central builds before 2026.3.1.14 Hotfix 4 that expose the pre-authentication /remoteControlAction.do?method=getPierDetails reconnaissance endpoint associated with CVE-2026-86218 static code injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect N-able N-central...
CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...
CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...
CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...