830 matches found
JumpServer > 3.6.4 - Information Disclosure
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...
GHSA-7236-3392-C5C6 vulnerabilities
Vulnerabilities for packages: guac, kaniko, podman, scorecard, kubescape, conftest...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, gobgp, crossplane-provider-aws-networkmanager-fips, lvm-driver, kepler-fips, crossplane-provider-aws-budgets, crossplane-provider-aws-elastictranscoder-fips, crossplane-provider-azure-keyvault, apko-fips, harbor-registry-fips,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: lvm-driver, kepler-fips, crossplane-provider-aws-budgets, gitlab-runner-operator-fips, perses-fips, addon-resizer, crossplane-provider-aws-servicediscovery-fips, opensearch-datasource, metrics-agent-fips, falcosidekick, prometheus-beat-exporter,...
GO-2026-4412 vulnerabilities
Vulnerabilities for packages: wolfictl, cg...
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: sqlx, qdrant, kdash, wash, wasmtime, nushell, zola, zed, deno, wasmcloud, buck2, shadowsocks-rust, wadm, zizmor, rye, ztunnel, uv, ntpd-rs, fnm, linkerd2-proxy, oranda, atuin, samply, linkerd-extension-init, parseable, ztunnel-fips, xh, rustup, sccache, pixi, tealdee...
GO-2026-5327 vulnerabilities
Vulnerabilities for packages: loki-fips, hubble, ratify-fips, authentik, virt-operator-fips, tetragon, tempo, terraform-provider-pagerduty-fips, opentelemetry-collector-contrib, trufflehog, thanos-receive-controller, tbot, datadog-agent, grafana-mimir-fips, grafana-mimir, kyverno,...
GO-2024-2453 vulnerabilities
Vulnerabilities for packages: gitness, flux-image-automation-controller, flux-kustomize-controller, pulumi-language-dotnet, crossplane-provider-aws-cloudformation, crossplane-provider-aws-s3, rclone, zarf, spire-server, gomplate, crossplane-provider-aws, crossplane-provider-aws-rds,...
GO-2026-5019 vulnerabilities
Vulnerabilities for packages: crossplane-provider-family-azure, crossplane-provider-azure-relay, terraform-fips, crossplane-provider-azure-synapse, apko-fips, crossplane-provider-azure-signalrservice, docker, tkn-fips, step-issuer-fips, commercial-grafana, terraform,...
GO-2025-3563 vulnerabilities
Vulnerabilities for packages: amazon-k8s-cni, lvm-driver, node-feature-discovery, harbor-registry-fips, terraform-provider-random-fips, addon-resizer, supercronic, google-guest-agent-manager, kapp, secrets-store-csi-driver-provider-gcp, elvish, crane-fips, s5cmd, paranoia, prometheus-alertmanager...
TP-Link-TL-WR841ND-Security-Audit
...
SVG `href` attribute bypasses local-reference restriction in Loofah
Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...
Decidim: CSV census record endpoints improper authorization
Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...
PT-2026-60064
Name of the Vulnerable Software and Affected Versions Decidim versions 0.31.1 through 0.31.4 Decidim version 0.32.0.rc1 Description An authorization bypass allows a normal participant to access the demographics questionnaire editor without the required administrator privileges. By directly loadin...
igracias-audit
🎯 iGracias Security Audit — Telkom University Comprehensive s...
Malicious Package
Overview apple-internal-security-audit-v99 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
Exploit for Missing Authentication for Critical Function in Cpanel
🔒 cPanel CVE-2026-41940 / nuclear.x86 Security Audit & Cleanup...
Malicious code in apple-internal-security-audit-v99 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c1a320034eadbc47dbe12b147164f4b003babca198b527d6b725a9f891f188 The package apple-internal-security-audit-v99 was found to contain malicious code. Source: ghsa-malware...
Beyond Code Reasoning: A Specification-Anchored Audit Framework for Expert-Augmented Security Verification
Security-critical software is routinely audited by tools that reason about vulnerabilities as repository-local code patterns. Yet specification-governed systems -- protocol stacks, consensus implementations, cryptographic libraries -- are constrained by invariants and correctness conditions defin...