17971 matches found
PT-2026-60684
Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...
PT-2026-60687
Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description Concurrent access to the mappingPath2Cache map in httpserver.go can lead to a control-plane Denial of Service. The ServeHTTP function reads from the map without a lock, while other...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet8.0: aspnetcore-runtime-8.0-8.0.28-1.2.hum1 aarch64, x8664 aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 aarch64, x8664 aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 aarch64, x8664...
CVE-2026-61643
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...
EUVD-2026-44661
A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...
CVE-2026-15809
The CVE-2026-15809 entry applies to CRI-O. It describes a bypass of the fix for CVE-2022-4318: an attacker who can set container environment variables can inject a newline into HOME, enabling addition of arbitrary lines to /etc/passwd via a crafted environment variable. Affected component is CRI-...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet9.0: aspnetcore-runtime-9.0-9.0.18-1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-9.0-9.0.18-1.hum1 aarch64, x8664 aspnetcore-targeting-pack-9.0-9.0.18-1.hum1 aarch64, x8664...
CVE-2026-59259
CVE-2026-59259 affects n8n released until versions 1.123.61, 2.27.4, and 2.28.1. The vulnerability is a permission bypass in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user who can create or update credent...
MAL-2026-10671 Malicious code in spytrack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...
MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...
RockyLinux 8 : kernel-rt (RLSA-2026:39180)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39180 advisory. kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46086 kernel: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete...
PT-2026-60132
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions prior to 2.28.1 Description A permission bypass exists in external secrets handling due to a mismatch between the static validation check and the runtime expression engin...
CVE-2026-47767
CVE-2026-47767 consolidates multiple disclosures of CVE-2024-50340: the vulnerability stems from a mismatch between parse_str()-built $_GET and web SAPI argv parsing when register_argc_argv=On, allowing crafted GET requests to flip APP_ENV/APP_DEBUG via SymfonyRuntime::getInput. Affected implemen...
CVE-2026-58527
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an authorized attacker to elevate privileges locally...
CVE-2026-54125
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an authorized attacker to elevate privileges locally...
CVE-2026-50503
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an authorized attacker to elevate privileges locally...
CVE-2026-50486
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally...
CVE-2026-50460
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an unauthorized attacker to elevate privileges over a network...