GHSA-J3RV-43J4-C7QM vulnerabilities

Vulnerabilities for packages: nextflow, strimzi-kafka-operator, thingsboard, flyway, spdx-tools-java, zipkin, sonarqube, keycloak-config-cli, logstash, confluent-kafka, druid, dependency-track, keycloak, zookeeper, wavefront-proxy, kafka, solr, akhq, confluent-common-docker, apicurio-registry,...

Malicious code in @su-doughnym/loginui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5768349705baa7b448fddb22d17412ce7befdaedd68b2e91a452eb6521e0bc66 Package self-identifies as a HubSpot dependency-confusion proof-of-concept and is published at version 99.99.99 — a typical high-version-pin used to...

Malicious code in two-factor-prompt-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95ebb96758f051c0a5a1c8fe97fb05c898f2489f4567fb64fbd271eb103dcadc Package self-identifies as a dependency-confusion proof-of-concept aimed at an internal/private package name. The postinstall script postinstall.js...

CVE-2026-44168

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...

CVE-2026-8658

CVE-2026-8658 describes an OS Command Injection in the Rapid7 InsightConnect Tcpdump Plugin running on Linux, caused by insufficient input sanitization during shell command construction. The vulnerability affects the plugin’s handling of options and filter parameters, allowing an authenticated at...

EUVD-2026-39161

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, maxttl, count, or timeout request parameters due to insufficient input validation when constructing shell...

CVE-2026-8666

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, maxttl, count, or timeout request parameters due to insufficient input validation when constructing shell...

CVE-2026-8592

The vulnerability CVE-2026-8592 affects the Rapid7 InsightConnect AWK Plugin (Linux) where the process_string action constructs shell commands unsafely in the processing pipeline, enabling OS command execution via text or expression parameters. This is a remote issue with potential impact on conf...

CVE-2026-8660

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands...

CVE-2026-8660 OS Command Injection in Rapid7 InsightConnect Ping Plugin

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands...

EUVD-2026-39148

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...

EUVD-2026-39149

Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must vis...

EUVD-2026-39116

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

EUVD-2026-39156

sys/kern/sysvsem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in syssemget...

CVE-2026-9780

Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must vis...

CVE-2026-7569

Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must vis...

PT-2026-52263

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fuse module where FUSE NOTIFY RETRIEVE is not limited to uptodate folios. Because FUSE NOTIFY RETRIEVE is designed to return data already present in the page cache...

PT-2026-52595

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw can be exploited to gain unauthoriz...

Linux Distros Unpatched Vulnerability : CVE-2026-53022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: dell-wmi-sysman: bound enumeration string aggregation populateenumdata aggregates firmware-provided value-modifier and possible-value strings into...

The vulnerability of the JWT/OIDC authentication method of the OpenBao encryption and secret management system allows attackers to perform XSS attacks.

The vulnerability of the JWT/OIDC authentication method of the OpenBao encryption system is related to the lack of mechanisms for encoding or shielding the output data. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...