30919 matches found
Security Bulletin: Carbon Charts React Router Security Vulnerabilities
Summary Carbon Charts versions prior to v1.27.8 include a vulnerable version of React Router that is susceptible to five security vulnerabilities CVE-2025-59057, CVE-2025-68470, CVE-2026-21884, CVE-2026-22029, CVE-2026-22030 with severity ranging from Medium to High CVSS 6.1 to 8.2. These...
Command Injection
Overview degit is a Straightforward project scaffolding Affected versions of this package are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec method by cloneWithGit and fetchRefs functions. An attacker can execute...
CVE-2026-3868
CVE-2026-3868 (Moxa Secure Router) involves improper handling of length parameters in the HTTPS management interface. An unauthenticated remote attacker can send crafted requests to trigger a buffer overflow, causing the web service to become unresponsive and potentially requiring a device reboot...
Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...
Fedora 44 : opkssh (2026-af08c3b44f)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-af08c3b44f advisory. Fix CVE-2026-34986 in bundled go-jose Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...
Fedora 44 : erlang (2026-2a93359b0b)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2a93359b0b advisory. Erlang ver. 26.2.5.19 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
Unity Linux 20.1070e Security Update: python3 (UTSA-2026-014306)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014306 advisory. User-controlled header names and values containing newlines can allow injecting HTTP headers. Tenable has extracted the preceding description block directly from the...
Fedora 44 : python3.13 (2026-80165205dc)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-80165205dc advisory. Update to 3.13.13 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
Insufficient Granularity of Access Control
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via insufficient access control in the gateway config.patch and config.apply processes. An attacker can modify protected operator settings by...
Insertion of Sensitive Information into Log File
Overview n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol MCP Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the request dispatcher and related logging. An attacker can obtain sensitive information, such...
GHSA-72H4-MXFC-JX37 Heimdall: Case-sensitive host matching may lead to policy bypass
Summary Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than...
Fedora 44 : pypy (2026-fdc024ddc3)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fdc024ddc3 advisory. JIT translation fix for bootstraping, require openssl 3 and fix CVE-2026-25645 and CVE-2025-8869 Tenable has extracted the preceding description blo...
Fedora 44 : sudo (2026-6894ade78f)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6894ade78f advisory. Fix CVE-2026-35535 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
Fedora 44 : opam (2026-afe659aa4d)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-afe659aa4d advisory. See https://github.com/ocaml/opam/releases/tag/2.5.1 for changes in version 2.5.1. Tenable has extracted the preceding description block directly from the...
Fedora 44 : libmicrohttpd (2026-17060a5ba0)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-17060a5ba0 advisory. Update to 1.0.5-1 ---- Update to 1.0.4-1 ---- Update to 1.0.3-1 Tenable has extracted the preceding description block directly from the Fedora...
CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copytarget/linktarget, symlinked parent directories in savetarget, or symlinked...
Use of Incorrectly-Resolved Name or Reference
Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference in StripPrefixRegex, when used together with ForwardAuth, BasicAuth, or DigestAuth. An attacker can gain unauthorized access to protected backend resources by sending requests with...
Arbitrary Command Injection
Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Command Injection via...
Insufficient Verification of Data Authenticity
Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the ForwardAuth middleware when trustForwardHeader is set to false and the deployment is behind a trusted upstream proxy. An attacker can gain unauthorized access to protected backend...
