196309 matches found
Medium: golang
Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...
CVE-2026-56397 SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package...
abd-clam (>=0.21.6, <=0.21.7), accesskit_windows (>=0.4.0, <=0.15.0) +2045 more potentially affected by unknown CVE via memmap2 (>=0.1.0, <=0.9.10)
memmap2 CARGO version =0.1.0, =0.21.6, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.18.0, =0.0.7, =0.0.8, =0.7.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0186...
RockyLinux 10 : yggdrasil-worker-package-manager (RLSA-2026:25999)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:25999 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 Tenable has extracted the preceding description block directly from...
Linux Distros Unpatched Vulnerability : CVE-2026-48936
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js Permission API can cause a local server to be started via a Unix domain socket, even without the --allow-net permission. This vulnerability...
MiracleLinux 8 : libxslt-1.1.32-6.4.el8_10 (AXSA:2026-796:02)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-796:02 advisory. libxslt: use-after-free with key data stored cross-RVT CVE-2025-10911 Tenable has extracted the preceding description block directly from the MiracleLinux...
RockyLinux 8 : dracut (RLSA-2026:26534)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26534 advisory. dracut: dracut: Root code execution via DHCP options command injection CVE-2026-6893 Tenable has extracted the preceding description block directly from the...
Linux Distros Unpatched Vulnerability : CVE-2026-46873
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: VMSVGA device. The supported version that is affected is 7.2.8. Difficult ...
Linux Distros Unpatched Vulnerability : CVE-2026-55203
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as...
@claude-flow/plugin-agent-federation (>=1.0.0-alpha.9, <=1.0.0-alpha.15), @turtlepusher/plugin-agent-federation (>=1.0.0, <=1.0.1) +2 more potentially affected by CVE-2026-58195 via agentic-flow (>=2.0.2-alpha, <=2.0.12-fix.8)
agentic-flow NPM version =2.0.2-alpha, =1.0.0-alpha.9, =1.0.0, =0.5.0, =0.3.0, =0.3.1 Source cves: CVE-2026-58195 Source advisory: OSV:GHSA-VCV2-R9JH-99M5...
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore is an open-source SDK that enables developers to build, deploy, and manage agents on AWS Bedrock AgentCore. An issue exists in the installpackages method of the Code Interpreter client where crafted package name arguments can bypass...
GHSA-6RFW-MQ36-JM8H Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore is an open-source SDK that enables developers to build, deploy, and manage agents on AWS Bedrock AgentCore. An issue exists in the installpackages method of the Code Interpreter client where crafted package name arguments can bypass...
Arbitrary Argument Injection
Overview bedrock-agentcore is an An SDK for using Bedrock AgentCore Affected versions of this package are vulnerable to Arbitrary Argument Injection via the installpackages function. An attacker can execute arbitrary commands within the sandboxed environment or redirect package resolution to a...
GHSA-8JVR-397X-XQH9 vulnerabilities
Vulnerabilities for packages: python...
@0xwork/connect (>=0.1.8, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +489 more potentially affected by CVE-2026-6733 via undici (>=8.0.0, <=8.4.1)
undici NPM version =8.0.0, =0.1.8, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.5.2-zh, =0.2.0, =0.18.5 and more Source cves:...
RHSA-2026:7634 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:27171 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:25143 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...