178621 matches found
CVE-2026-59901 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, cassandra, apicurio-registry, management-api-for-apache-cassandra-5.0, zookeeper, trino, spark, kserve-modelmesh, zipkin, akhq, celeborn, opensearch, cloudwatch-exporter, wavefront-proxy, apache-activemq-artemis, infinispan, thingsboard, apache-nifi...
GHSA-558V-64GR-WGG4 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, cassandra, apicurio-registry, management-api-for-apache-cassandra-5.0, zookeeper, trino, spark, kserve-modelmesh, zipkin, akhq, celeborn, opensearch, cloudwatch-exporter, wavefront-proxy, apache-activemq-artemis, infinispan, thingsboard, apache-nifi...
GHSA-558V-64GR-WGG4 vulnerabilities
Vulnerabilities for packages: zipkin, wavefront-proxy, apicurio-registry, apache-pulsar-fips, celeborn, apache-nifi, conductor, pinot, kafbat-ui-fips, infinispan, apache-hop-fips, opensearch-fips, request-9047-keycloak-fips, floci-az, cassandra-fips, apicurio-registry-fips, logstash-fips,...
CVE-2026-59901 vulnerabilities
Vulnerabilities for packages: zipkin, wavefront-proxy, apicurio-registry, apache-pulsar-fips, celeborn, apache-nifi, conductor, pinot, kafbat-ui-fips, infinispan, apache-hop-fips, opensearch-fips, request-9047-keycloak-fips, floci-az, cassandra-fips, apicurio-registry-fips, logstash-fips,...
Important: Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull...
Exploit for CVE-2026-56121
CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...
EUVD-2026-47593
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...
CVE-2026-16489
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...
OPENSUSE-SU-2026:11328-1 distribution-registry-3.1.1-4.1 on GA media
These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-64053
These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-16489
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...
CVE-2026-16489
CVE-2026-16489 affects jsforce up to 3.10.16 in the SFDX Connection Registry. The vulnerability targets the function _execCommand within lib/registry/sfdx.js, enabling OS command injection from a local environment. An exploit is publicly available; the issue was reported early but no remediation ...
CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...
CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the AddPackageTag function. An attacker can cause the server to exhaust memory resources and crash by sending a large HTTP request body to the affected API endpoint, as the entire...
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...
GHSA-9MQ6-MQJJ-C2C5 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +12 more potentially affected by CVE-2026-73653 via @vitest/browser (>=4.0.0, <=4.1.9)
@vitest/browser NPM version =4.0.0, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =0.2.1, =0.2.2, =4.0.0-beta.15, =4.0.0-beta.15, =4.0.0-beta.15, =0.5.0-rc.1, =0.1.0, =0.2.0, =0.2.3 Source cves: CVE-2026-73653 Source advisory:...