980512 matches found
AlmaLinux 10 : python3.12 (ALSA-2026:10711)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10711 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...
IBM Watsonx.data 安全漏洞
IBM Watsonx.data is an open data lake platform developed by IBM. Versions 2.2 to 2.3 of IBM Watsonx.data contain security vulnerabilities. These vulnerabilities stem from insufficient restrictions on communication between Pods, allowing attackers to transfer data between Pods without any...
Important: python3.14
Issue Overview: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters. CVE-2026-0672 The fix for CVE-2026-0672, which rejected control characters...
PT-2026-36203
Name of the Vulnerable Software and Affected Versions HKUDS OpenHarness affected versions not specified Description A remote code execution issue exists in the '/bridge' slash command. Remote senders accepted by the configuration can execute arbitrary operating system commands. This occurs when t...
MiracleLinux 9 : python3.9-3.9.25-3.el9_7.3 (AXSA:2026-513:04)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-513:04 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...
Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-025 (ALASTOMCAT9-2026-025)
The version of tomcat installed on the remote host is prior to 9.0.117-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-025 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via...
SQL Injection
Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...
Open Redirect
Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Open Redirect in the handleSSORequest process. An attacker can obtain sensitive user identity attributes and impersonate users by...
Exploit for Server-Side Request Forgery in Chamilo Chamilo_Lms
CVE-2026-33715 — Unauthenticated SSRF + Open Email Relay in Ch...
Malicious code in @breezeai-frontend/tailwind-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93dd597412bdae22d265ee51f76a40cefa637f09bdf73cb7ede9ac63daf05ac8 The package @breezeai-frontend/tailwind-config was found to contain malicious code. Source: ghsa-malware...
Open Redirect
Overview n8n-editor-ui is a Workflow Editor UI for n8n Affected versions of this package are vulnerable to Open Redirect via the handleDeny process. An attacker can redirect users to an external, attacker-controlled site by registering arbitrary redirecturi values and enticing victims to interact...
n8n has Open Redirect in MCP OAuth Consent Flow
Impact The /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirecturi values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirecturi without validation,...
GHSA-F6X8-65Q6-J9M9 n8n has Open Redirect in MCP OAuth Consent Flow
Impact The /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirecturi values to be registered. When a user denies the MCP OAuth consent dialog, the handleDeny handler redirects the user to the registered redirecturi without validation,...
security-advisories
Security Advisories Public write-ups and PoCs for CVEs I've d...
CVE-2026-41910
OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model...
CVE-2026-40260 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-3CRG-W4F6-42MX vulnerabilities
Vulnerabilities for packages: open-webui...