Linux Distros Unpatched Vulnerability : CVE-2026-8390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. CVE-2026-8390 Note that Nessus relies on the presence ...

Schneider Electric Ecostruxure Machine Expert HVAC security vulnerabilities

Schneider Electric Ecostruxure Machine Expert HVAC is a software platform developed by Schneider Electric, a French company, dedicated to the control and automation of heating, ventilation, and air conditioning equipment. Schneider Electric Ecostruxure Machine Expert HVAC has a security...

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2ECS-2026-112 (ALASECS-2026-112)

The version of oci-add-hooks installed on the remote host is prior to 0-0.9.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-112 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...

WS-2017-0148

Affected versions of the package are vulnerable to Cross-site Scripting XSS due to using a non-cryptographic hash map to store connection IDs...

WS-2017-0248

Affected versions of the package are vulnerable to Chosen Cyphertext Attack...

WS-2018-0001

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors...

WS-2017-0184

Affected versions of the package are vulnerable to Directory Traversal...

WS-2017-0142

Affected versions of the package are vulnerable to Cross-site Scripting XSS...

WS-2017-0145

Affected versions of the package are vulnerable to Cross-site Scripting XSS...

WS-2017-0235

Affected versions of the package expose absolute paths for plugin includes...

WS-2017-0232

Affected versions of the package are vulnerable to Cross-site Scripting XSS...

WS-2017-0233

Affected versions of the package are vulnerable to Cross-site Scripting XSS...

WS-2017-0252

Affected versions of the package greater than 5.1.1.beta are vulnerable to Information Exposure...

WS-2017-0239

Affected versions of the package are vulnerable to Directory Traversal attacks...

WS-2017-0133

Affected versions of the package are vulnerable to HTML Injection...

EUVD-2026-30106

An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode. The...

CVE-2026-44418

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via strreplace without any sanitization, enabling SQL injection through query parameters th...

CVE-2026-44379

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues o...

MAL-2026-3710 Malicious code in ethers-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8f43ab2ac9caeed4f5dd0895f4da7d3a646038768f5d0024f443bb527fd1ad95 The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2026-33378

Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server...