28519 matches found
MiracleLinux 7 : glusterfs-3.8.4-54.10.el7 (AXSA:2018-3234:05)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3234:05 advisory. GlusterFS is a key building block of Asianux Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for divers...
CVE-2026-1011
A stored cross-site scripting XSS vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST...
CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...
GHSA-F2PH-GC9M-Q55F lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()
A use-after-free vulnerability was found in the Ceph client session initialization in the Linux kernel. The havemonandosdmap function checks map epochs without holding the appropriate locks, racing with concurrent map updates that free the old map. This can result in dereferencing freed memory...
PT-2026-3144
A stored cross-site scripting XSS vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST...
Altium 365 security vulnerabilities
Altium 365 is a product design and development platform provided by the American company Altium. There is a security vulnerability in Altium 365, which stems from the lack of server-side input validation in the workflow form submission API. This vulnerability may lead to storage-based cross-site...
Tagstoo Cross-Site Scripting Vulnerability
Tagstoo is a tag-based file manager developed by Pablo Andueza. Version 2.0.1 of Tagstoo contains a cross-site scripting vulnerability. This vulnerability arises from improper handling of file or custom tag inputs, which may lead to storage-based cross-site scripting attacks...
lakeFS security vulnerability
LakeFS is an open-source tool developed by Treeverse. It allows you to convert your object storage into a repository similar to Git. Versions of LakeFS prior to 1.75.0 contained security vulnerabilities. These vulnerabilities stemmed from the S3 gateway not verifying the timestamps in authenticat...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003380)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003380 advisory. The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service out-of- bounds read and system crash or possibly have unspecified...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003476)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003476 advisory. The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service out-of- bounds read and system crash or possibly have unspecified...
PT-2026-3139
Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.75.0 Description lakeFS's S3 gateway does not validate timestamps in authenticated requests, which allows for replay attacks. An attacker capturing a valid signed request can replay it until credentials are rotated,...
Each Italy Wireless Mini Router WIRELESS-N 300M has security vulnerabilities
The Each Italy Wireless Mini Router WIRELESS-N 300M is a wireless router produced by Each Italy. There is a security vulnerability in the version v28K.MiniRouter.20190211 of the Each Italy Wireless Mini Router WIRELESS-N 300M. This vulnerability stems from the lack of cleaning of the repeater AP...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003001)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003001 advisory. A security flaw was found in the chapservercomputemd5 function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiato...
CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
CVE-2026-22240 Plaintext Passwords Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...
CVE-2026-22240 Plaintext Passwords Vulnerability in BLUVOYIX
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the...