@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agentforce/adk (>=0.9.0, <=0.12.1) +573 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.12.12)

hono NPM version =4.0.0, =0.3.1, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.16 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-16080667...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agentforce/adk (>=0.9.0, <=0.12.1) +573 more potentially affected by CVE-2026-56761 via hono (>=4.0.0, <=4.12.12)

hono NPM version =4.0.0, =0.3.1, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.16 and more Source cves: CVE-2026-56761 Source advisory: OSV:GHSA-458J-XX4X-4375...

PT-2026-35301

Summary The authenticated middleware uses unanchored regular expressions to match public no-auth endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query paramete...

PT-2026-33309

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-3489: Improper Neutralization of Special Elements used in an SQL Command

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

AlmaLinux 8 : pcs (ALSA-2026:8093)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:8093 advisory. tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9 : nghttp2 (ALSA-2026:7668)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7668 advisory. nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27135 Tenable has extracted the preceding description block...

AlmaLinux 9 : bind (ALSA-2026:8075)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:8075 advisory. bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block directly from the...

PT-2026-35307

Summary Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes to forward slashes / for special schemes, a payload such as /evil.com/path slips through is relative url, is emitted unchanged in th...

PT-2026-35316

Summary A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and...

RockyLinux 10 : bind (RLSA-2026:8312)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:8312 advisory. bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block directly from the...

@amedia/brick-mcp (>=0.0.0-vBRAND-20260313141110, <=1.0.3), @area15/ticket-component (0.1.0) +229 more potentially affected by CVE-2025-32442 +1 more via fastify (>=5.3.2, <=5.8.4)

fastify NPM version =5.3.2, =0.0.0-vBRAND-20260313141110, =2.0.1, =1.1.1, =0.6.2, =0.1.1, =0.1.1, =0.6.0, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =0.1.0, =0.8.2 and more Source cves: CVE-2025-32442, CVE-2026-33806 Source advisory: OSV:GHSA-247C-9743-5963...

CVE-2026-27482 vulnerabilities

Vulnerabilities for packages: airflow...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-33808 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-33808 Source advisory: SNYK:JS-FASTIFYEXPRESS-16068303...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.26: golang1.26-1.26.2-1.1.hum1 aarch64, x8664 golang1.26-bin-1.26.2-1.1.hum1 aarch64, x8664 golang1.26-docs-1.26.2-1.1.hum1 noarch golang1.26-misc-1.26.2-1.1.hum1 noarch...

Oracle Linux 9 : bind9.18 (ELSA-2026-7915)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7915 advisory. - Correct backport issue in the patch CVE-2026-1519 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Linux Distros Unpatched Vulnerability : CVE-2026-6311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to...

Linux Distros Unpatched Vulnerability : CVE-2026-6362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted vid...

Linux Distros Unpatched Vulnerability : CVE-2026-6359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of...

Linux Distros Unpatched Vulnerability : CVE-2026-6305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF...