44264 matches found
GHSA-35JH-R3H4-6JHM vulnerabilities
Vulnerabilities for packages: py3-captum...
CVE-2026-58207
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal...
CVE-2026-58210
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the...
CVE-2026-58209
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these...
CVE-2026-58254
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...
CVE-2026-58252
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset...
AZL-92303 CVE-2026-39822 affecting package golang for versions less than 1.25.12-1
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
UBUNTU-CVE-2026-39822
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
CVE-2026-43319 affecting package kernel for versions less than 6.6.142.1-1
CVE-2026-43319 affecting package kernel for versions less than 6.6.142.1-1. A patched version of the package is available...
CVE-2026-44889 affecting package python-webob for versions less than 1.8.10-1
CVE-2026-44889 affecting package python-webob for versions less than 1.8.10-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-39822 Root escape via symlink plus trailing slash in os
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
Malicious code in @vite-ln/build-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8972bbfdd55ad200dd49b08501d7391beca99841f0c36479806f2b1e329950a2 Package @vite-ln/build-ts copies the legitimate vite package's manifest verbatim description 'Native-ESM powered web dev build tool', author 'Evan...
Malicious code in nam-os-a-man (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a483a2ae78f1f6f7d3d4da1ab74cc189f29564e002299f09c19e0d3eb41e40aa The package declares a postinstall hook that runs index.js on npm install. index.js collects the installer's OS username os.userInfo.username, hostna...
GHSA-QCXP-RJ5J-4RR9 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-qemu, linux-gcp, linux-aws, linux-vmware...
GHSA-VCCQ-H5J4-92QR vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-qemu, linux-gcp, linux-aws, linux-vmware...
GHSA-VG6G-9H68-878W vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-qemu, linux-gcp, linux-aws, linux-vmware...
CVE-2026-53181 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-qemu, linux-gcp, linux-aws, linux-vmware...
GHSA-8CG3-6H68-W2CJ vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-qemu, linux-gcp, linux-aws, linux-vmware...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
