194883 matches found
RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...
GHSA-G352-92JC-35RP vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-W67G-5RQW-F597 vulnerabilities
Vulnerabilities for packages: cluster-api-fips, aws-node-termination-handler, virt-handler-fips, amazon-cloudwatch-agent, infinispan-operator, cloudflared, containerd, redis-operator-fips, kubevela, virt-handler, cloudflared-fips, cosmo-router-fips, amazon-ssm-agent-fips, milvus, etcd,...
CLSA-2026-1787673947 TuxCare security update for io.netty (3 CVEs)
TuxCare rebuilt 46 io.netty packages to address 3 CVEs. Fixed in 4.1.82.Final-tuxcare.7...
CLSA-2026-1787672438 TuxCare security update for io.netty (6 CVEs)
TuxCare rebuilt 47 io.netty packages to address 6 CVEs. Fixed in 4.1.130.Final-tuxcare.4...
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't...
CLSA-2026-1787658666 TuxCare security update for 123 packages (1 CVE)
TuxCare rebuilt 123 packages to address 1 CVE. Fixed in 11.0.28.tuxcare0004...
RHSA-2026:59361 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHBA-2022:3917 Red Hat Bug Fix Advisory: new packages: glibc
Bulletin has no description...
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-50645 vulnerabilities
Vulnerabilities for packages: apache-tika...
EUVD-2026-65120
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554
CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...
EEF-CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Summary Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicit...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75542
CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...
EUVD-2026-65119
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...