336644 matches found
Photon OS 5.0: Sqlite PHSA-2026-5.0-92-0889
An update of the sqlite package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0889. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Rust PHSA-2023-5.0-91-0067
An update of the rust package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0067. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
GL.iNet GL-MT3000 Router set_upgrade() Command Execution
The vulnerability of the setupgrade function at the /cgi-bin/glc endpoint of the modem.so component of the GL.iNet GL-MT3000 router software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow an attacker to inject arbitrary commands remotely...
CVE-2026-20311: Buffer Over-read
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management...
CVE-2026-20308: Improper Privilege Management
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service DoS attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could...
CVE-2026-20301: Unchecked Input for Loop Condition
A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...
CVE-2026-20267: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...
CVE-2026-20263: Undefined Security Weakness
A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...
Photon OS 5.0: Linux PHSA-2024-5.0-91-0374
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0374. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...
CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...
kin v0.4.8
The diff is not the change. AI agents can write a change faster than a team can establish what it touches, whether it reverses an earlier fix, and how far its consequences reach. Git records files and line history. Kin records the software itself as a graph of entities, relations, changes, and...
Security Bulletin: Multiple vulnerabilities have been identified in IBM® SDK, Java™ Technology Edition, an IBM Websphere (WAS) prerequisite. WAS is used by IBM Rational ClearQuest
Summary IBM® SDK, Java™ Technology Edition is a prerequisite in order to use IBM WebSphere Application ServerWAS. WAS is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition have been published in a security bulletin...
DoS (Denial of Service) immutable Dependency in Jira Software Data Center
This DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.1, 10.5.0, 10.6.0, 10.7.1, 11.0.0, and 11.1.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...
Information Disclosure axios Dependency in Jira Software Data Center
This High severity Information Disclosure vulnerability was introduced in versions 10.3.22 and 11.3.7 of Jira Software Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an...
Malicious code in @servicetitan/microfront-tests (npm)
npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/acquisition-functions (npm)
npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...
MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)
npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...