606880 matches found
Fedora 43 : nextcloud (2026-51116fe081)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51116fe081 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...
gio-branding-upstream-2.88.3-1.1 on GA media (moderate)
gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: localstack, kserve, dbt-bigquery, authentik, airflow, kubeflow-pipelines, lmcache-cuda-12.8, mlflow, duplicity, authentik-fips, wazuh-manager-fips, openstack-keystone-2025.1, openstack-keystone-2026.1, superset, datahub-ingestion, py3-cassandra-medusa,...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: localstack, kserve, dbt-bigquery, authentik, airflow, kubeflow-pipelines, lmcache-cuda-12.8, mlflow, duplicity, authentik-fips, wazuh-manager-fips, openstack-keystone-2025.1, openstack-keystone-2026.1, superset, datahub-ingestion, py3-cassandra-medusa,...
CVE-2026-54787 vulnerabilities
Vulnerabilities for packages: aactl, zarf, crossplane, goreleaser, flux-source-controller, neuvector-sigstore-interface, spire-server, falcoctl, kyverno-notation-aws, tekton-chains, kubescape, policy-controller, trivy-operator, trivy, ko, zot, kyverno, skaffold, tkn...
GHSA-WQQC-JJCQ-VFXM vulnerabilities
Vulnerabilities for packages: aactl, zarf, crossplane, goreleaser, flux-source-controller, neuvector-sigstore-interface, spire-server, falcoctl, kyverno-notation-aws, tekton-chains, kubescape, policy-controller, trivy-operator, trivy, ko, zot, kyverno, skaffold, tkn...
GHSA-WG4G-WM44-CH5J vulnerabilities
Vulnerabilities for packages: rke2-runtime, kubo-fips, telegraf, ipfs-cluster-fips, spegel-fips, spegel, livekit-egress, k3s, kubo, rke2-runtime-fips, ipfs-cluster...
CVE-2026-54909 vulnerabilities
Vulnerabilities for packages: rke2-runtime, kubo-fips, ipfs-cluster-fips, spegel-fips, spegel, livekit-egress, stunnerd, k3s, kubo, rke2-runtime-fips, ipfs-cluster...
MAL-2026-11427 Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
UBUNTU-CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...