28659 matches found
PT-2026-36176
Name of the Vulnerable Software and Affected Versions Secure Access Windows client versions prior to 14.50 Description A buffer overflow occurs in the software, which allows attackers with local control of the Windows client to cause a system crash, resulting in a blue screen. Recommendations...
PT-2026-36100
CVE-2026-31431 is another reminder that one unpatched vulnerability can turn a small foothold into full system compromise. For businesses running remote teams, cloud workloads, or distributed infrastructure, secure access and layered protection matter more than ever. Patch fast. Limit exposure...
Absolute Secure Access 安全漏洞
Absolute Secure Access is an application developed by Absolute Corporation. It provides secure service edge SSE services optimized for mixed and mobile work environments. Versions of Absolute Secure Access prior to 14.50 contained a security vulnerability caused by a buffer overflow, which could...
PT-2026-36173
Name of the Vulnerable Software and Affected Versions Secure Access client versions prior to 14.50 Description A buffer overflow exists in a message handling function of the client. Attackers controlling a modified server can send a cryptographically valid message to overwrite a small portion of...
April 30, 2026—KB5083631 (OS Builds 26200.8328 and 26100.8328) Preview
None None...
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
Impact A flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining t...
CLSA-2026-1777479123 openssh: Fix of CVE-2026-35385
CVE-2026-35385: scp legacy -O mode privilege escalation via umask bypass...
golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSHAGENTSUCCESS 0x06 message to requests expecting typed replies e.g., List, Sign. The unmarshal layer produces an unexpected message type, which the client code does not handle,...
CVE-2026-5545
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid...
USN-8222-1 openssh vulnerabilities
Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol -O option. This could result in certain files being installed setuid or setgid, contrary to expectations. CVE-2026-35385 Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell...
MAL-2026-3180 Malicious code in nicegui (npm)
Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...
CLSA-2026-1777452220 cockpit: Fix of CVE-2026-4631
CVE-2026-4631: Fix SSH command-line argument injection in cockpit-ws / beiboot Critical RCE...
MAL-2026-3157 Malicious code in apple-internal-auth-v3 (npm)
Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...
The vulnerability of the Secure Boot component in Linux operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Secure Boot component in Linux operating systems is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...
ROS-20260429-73-0042
A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...
CLSA-2026-1777378650 Fix CVE(s): CVE-2023-26604
SECURITY UPDATE: systemctl may pass arbitrary shell commands from a pager like more1 that does not honor LESSSECURE, allowing privilege escalation under sudo. - debian/patches/CVE-2023-26604.patch: set LESSSECURE=1 when invoking a pager, rename to SYSTEMDPAGERSECURE, gate insecure pagers behind...
Linux kernel double free in Xen privcmd driver
ISSUE DESCRIPTION The Linux kernel's privcmd driver can be abused to circumvent kernel lockdown secure boot by causing a double free of kernel memory. Note that this operation can be performed by root only, so any further impact on the system like denial of service is not security relevant. IMPAC...
CVE-2026-7039
A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection. The attack must be carried out locally. The exploit has been disclosed...
