264149 matches found
SUSE CVE-2026-54531
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0...
CVE-2026-53532
creationtimestamp| type| source ---|---|--- 2026-06-20 02:01:08+00:00| seen| https://bsky.app/profile/slackers.it/post/3moor6754ks2n...
CVE-2026-56213
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsertversionmeta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into versionmeta for any appid. Attackers can exploit this by calling the RPC...
CVE-2026-11551
creationtimestamp| type| source ---|---|--- 2026-06-20 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mookgqp4bp2f 2026-06-20 00:00:46+00:00| seen| https://infosec.exchange/users/offseq/statuses/116779492087943579 2026-06-20 01:01:06+00:00| seen|...
PT-2026-51179
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...
Fedora 45 : python-mistune (2026-182b5d52c9)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-182b5d52c9 advisory. Automatic update for python-mistune-3.2.1-1.fc45. Changelog Thu Jun 18 2026 Miro Hronok - 3.2.1-1 - Update to 3.2.1 - Security fix for CVE-2026-44898 - Fixes...
Photon OS 5.0: Util PHSA-2026-5.0-0885
An update of the util package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0885. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
python311-joserfc-1.7.1-1.1 on GA media (moderate)
python311-joserfc-1.7.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11067-1 Rating: moderate Cross-References: CVE-2026-48990 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
CVE-2008-2474
creationtimestamp| type| source ---|---|--- 2026-06-19 23:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mooj4nccpj24...
CVE-2026-48772
creationtimestamp| type| source ---|---|--- 2026-06-19 22:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mooef5dho623 2026-06-20 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116780553070568538 2026-06-20 04:30:28+00:00| seen|...
GHSA-C3XH-98XP-6QHF githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash...
CVE-2026-56120
creationtimestamp| type| source ---|---|--- 2026-06-19 21:43:17+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h3m5-97jq-qjrf 2026-06-24 00:30:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynwor2ys23 2026-06-24 00:44:55+00:00| seen|...
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Summary network-ai's ApprovalInbox lib/approval-inbox.ts is a shipped, exported, documented feature — "a web-accessible approval queue with REST API … and SSE streaming" SECURITY.md. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit huma...
GHSA-JVCM-F35G-W78P Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...
GHSA-2FMP-9RVW-HC96 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Summary EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive: true, force: true . An attacker who can place or modify a manifest inside...
OpenBao's System Backend allows Unauthorized Management of the containing Namespace
Summary A user that is granted namespace management /sys/namespaces capabilities within a non-root namespace "the victim namespace" can abuse special handling of the literal path "root" in namespace path canonicalization to manage the victim namespace itself. Details Several endpoints under...
CVE-2026-56081 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account...
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Overview CoreWCF.Primitives is a port of the service side of Windows Communication Foundation WCF to .NET Core. The goal of this project is to enable existing WCF services to move to .NET Core. Affected versions of this package are vulnerable to Selection of Less-Secure Algorithm During Negotiati...
