167456 matches found
Photon OS 5.0: Sqlite PHSA-2026-5.0-92-0889
An update of the sqlite package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0889. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Curl PHSA-2026-5.0-91-0838
An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0838. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Linux PHSA-2024-5.0-91-0393
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0393. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Samba PHSA-2026-5.0-91-0733
An update of the samba package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0733. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Nghttp2 PHSA-2023-5.0-91-0126
An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0126. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Linux Distros Unpatched Vulnerability : CVE-2026-64576
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nexthop: initialize extack in nhresbucketmigrate nhresbucketmigrate passes an uninitialized netlinkextack to callnexthopresbucketnotifiers. When...
Linux Distros Unpatched Vulnerability : CVE-2026-71226
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later...
Photon OS 5.0: Linux PHSA-2025-5.0-91-0575
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0575. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Linux Distros Unpatched Vulnerability : CVE-2026-67591
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ...
openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)
A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...
GHSA-7MPP-R37J-X5WH Ghost: Session Fixation in Ghost Admin
Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...
GHSA-GCVV-72Q8-9V76 Ghost: Server-Side Request Forgery in Image Fetching
Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...
GHSA-JM22-3W23-5Q7W Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
Ghost: Cross-Site Scripting in Universal Import
Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters...
NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-69263 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...
ROOT-APP-PYPI-CVE-2026-32597 CVE-2026-32597 in PyJWT - Patched by Root
Root has patched CVE-2026-32597 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48525 CVE-2026-48525 in PyJWT - Patched by Root
Root has patched CVE-2026-48525 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
CVE-2026-69254
CVE-2026-69254 affects Flowise versions before 3.1.3. The issue arises in the executeJavaScriptCode() path where caller-provided nodeVMOptions are merged with default NodeVM security settings, allowing an attacker to override the sandbox protection. By reaching packages/server/src/routes/node-cus...