262258 matches found
SUSE CVE-2026-0864
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value...
CVE-2026-57589
creationtimestamp| type| source ---|---|--- 2026-06-25 02:29:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3f447rn42l 2026-07-08 01:10:04+00:00| seen| https://bsky.app/profile/lobsters-feed.bsky.social/post/3mq3wpi5hat2y 2026-07-08 10:01:20+00:00| seen|...
SUSE CVE-2026-40186
ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements textarea and option...
SUSE CVE-2026-54515
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion, producing a...
GHSA-J3RV-43J4-C7QM vulnerabilities
Vulnerabilities for packages: cassandra-reaper, ruby3.3-jrjackson, keycloak, sonarqube, celeborn, zipkin, wavefront-proxy, druid, strimzi-kafka-operator, tez, airflow, neo4j, spark, jenkins, apache-pulsar, infinispan, nextflow, solr, kafka, confluent-common-docker, keycloak-config-cli, scala,...
CVE-2026-55454
creationtimestamp| type| source ---|---|--- 2026-06-25 00:00:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mp34rdzebt2t 2026-06-25 00:01:01+00:00| seen| https://infosec.exchange/users/offseq/statuses/116807803619283441 2026-06-25 02:18:48+00:00| seen|...
PT-2026-52611
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.10 Description An authenticated user can change their account password through the account settings Security section without providing the current password or any additional verification. This occurs because the...
PT-2026-52525
Name of the Vulnerable Software and Affected Versions pnpm versions 11.3.0 through 11.5.2 Description The pnpm stage download command derives a local filename using package name and version fields controlled by the registry. A crafted manifest can lead to a path traversal, allowing an attacker to...
ROS-20260625-73-0015
The vulnerability of the comparestrings function in the GnuTLS library is related to shortcomings in the mechanism for handling register-dependent data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
PT-2026-52490
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 commit bb58a2d0 added limits: fileSize to createMulterInstance in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that w...
PT-2026-52621
Name of the Vulnerable Software and Affected Versions vtk vtk-dicom affected versions not specified Description A heap-based buffer overflow occurs in the vtkDICOMItem::NewDataElement function. A heap-based buffer overflow is a memory corruption issue that happens when a program writes more data ...
Oracle WebCenter Portal (June 2026 CSPU)
The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supporte...
LangChain < 1.3.9 Path Traversal (CVE-2026-55443)
The version of LangChain installed on the remote host is prior to 1.3.9. It is, therefore, affected by a path traversal vulnerability: - Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root director...
RockyLinux 9 : libfastjson (RLSA-2023:6431)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:6431 advisory. json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file CVE-2020-12762 Tenable has extracted the preceding description block directly...
CVE-2026-40079
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand function. The escapecommand function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built ...
CVE-2026-39955
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTERVALIDATEREGEXP in graphview.php. This issue has been fixed in version 1.2.31...
CVE-2026-33543
creationtimestamp| type| source ---|---|--- 2026-06-24 22:25:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xgkyhne2g...
CVE-2026-54070
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...
Use of a Key Past its Expiration Date
Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the password-reset token generation process. An attacker can gain unauthorized access to user accounts by exploiting the extended validity period of reset tokens, even when a shorter expirati...