144214 matches found
Malicious Package
Overview sea-bound-siren is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...
GHSA-XM63-5PJX-VRHP vulnerabilities
Vulnerabilities for packages: busybox...
GHSA-R8F8-4PGH-4M8V vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-49993 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...
CGA-72J5-497F-56J2
Bulletin has no description...
RUSTSEC-2026-0178 Panic on a `DataRow` with fewer fields than columns allows denial of service
A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and...
CGA-7WMM-JPFJ-WGPV
Bulletin has no description...
OESA-2026-2672 perl-HTML-Parser security update
Objects of the HTML::Parser class will recognize markup and separate it from plain text alias data content in HTML documents. As different kinds of markup and text are recognized, the corresponding event handlers are invoked. Security Fixes: HTML::Entities versions before 3.84 for Perl read freed...
CVE-2026-50627
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' Audience claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users...
RHSA-2026:25225 Red Hat Security Advisory: mod_http2 security update
Bulletin has no description...
RHSA-2026:25217 Red Hat Security Advisory: kernel security update
Bulletin has no description...
EUVD-2026-36397
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgra...
GHSA-CXH2-4639-VMC5 vulnerabilities
Vulnerabilities for packages: kube-logging-operator-fips, kube-logging-operator...
GHSA-6V8Q-G97G-72XJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-282G-W5FH-9Q49 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-3VRF-5PC8-4996 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-6MR8-WMR4-CH9V vulnerabilities
Vulnerabilities for packages: chromium...