54123 matches found
PT-2026-5268
The $uri$args concatenation in nginx configuration file present in Open Security Issue Management OSIM prior v2025.9.0 allows path traversal attacks via query parameters...
Open Security Issue Management – Security Vulnerabilities
Open Security Issue Management is a web UI interface provided by Red Hat Product Security. Versions of Open Security Issue Management prior to v2025.9.0 contain security vulnerabilities. These vulnerabilities stem from improper concatenation of $uri$args in the nginx configuration file, which may...
AZL-78925 CVE-2025-61726 affecting package golang 1.25.7-1
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containi...
CVE-2025-14988
ibaPDA is affected (PT-2026-5016) with version 8.12.0 showing a permission flaw that grants unrestricted filesystem access without authentication, enabling unauthorized actions on the file system and impacting confidentiality, integrity, and availability. No fix version is disclosed in the provid...
CVE-2025-14988
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system...
PT-2026-5016
Name of the Vulnerable Software and Affected Versions ibaPDA version 8.12.0 Description A security issue exists in ibaPDA that could allow unauthorized actions on the file system. This may impact the confidentiality, integrity, or availability of the system. The issue is a permission flaw that...
pnpm has Path Traversal via arbitrary file permission modification
Summary When pnpm processes a package's directories.bin field, it uses path.join without validating the result stays within the package root. A malicious npm package can specify "directories": "bin": "../../../../tmp" to escape the package directory, causing pnpm to chmod 755 files at arbitrary...
ROS-20260126-73-0001
A vulnerability in the index.c component of the Linux operating system kernel is related to integer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
CVE-2026-24404
creationtimestamp| type| source ---|---|--- 2026-01-24 03:24:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5bc77w5e2n...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2026:0218-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0218-1 advisory. Update to go1.25.6 released 2026-01-15 bsc1244485 Security fixes: - CVE-2025-61730: crypto/tls:...
Malicious code in h-jsencrypt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb69a1fb2f3c3ef16b7e30994095eb335b41563a498523667d83d60ed0c56c60 The package h-jsencrypt was found to contain malicious code. Source: ghsa-malware a2cacebaa99bf1715c395ba91c26e95c4ce77af5a16cbbcc4e5041c2a47b4143 An...
Malicious code in test-on-other (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaeca000a0d70bc52934cc2047e1924aa1f63f790734f0063a190476e7accdf2 The package test-on-other was found to contain malicious code...
CVE-2026-1299
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email foldin...
CVE-2025-3839
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...
Malicious code in oasis-os-provider-messaging (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cca1eb9a5a42a34b2db68e6d23c9c2cd2cbe7098f742e647c9c6867b342e95ab The package oasis-os-provider-messaging was found to contain malicious code...
EUVD-2026-4268
Gitea improperly exposes issue and pull request titles...
PT-2026-4293
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user may be able to modify the visibility settings of other users' OpenID identities due to improper ownership validation when toggling OpenID URI visibility. Recommendations A...
WordPress plugin xSmart has a security vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
CVE-2026-21943
creationtimestamp| type| source ---|---|--- 2026-01-21 08:23:53+00:00| seen| https://gist.github.com/Darkcrai86/9e07e2b9d2b4a7f979e9ed65b6569b80 2026-01-21 21:18:16+00:00| seen| https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875...