23739 matches found
Astra Linux – Vulnerability in Firefox and Thunderbird
Relative URLs that start with three slashes were incorrectly parsed. The “path-traversal” /../ part in the path could be used to override the specified host. This could lead to security issues in websites. This vulnerability affects Firefox 120, Firefox ESR 115.5.0, and Thunderbird 115.5...
Astra Linux – Vulnerability in Python 3.7, Python 2.7
There is a flaw in the urllib’s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server to which an HTTP client such as a web browser connects can trigger a Regular Expression Denial of Service ReDOS during an authentication request. This occurs when the server sends a...
Astra Linux – Vulnerability in PHP 7.3, PHP 8.1
Due to an incomplete fix for CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p, network and same-site attackers can set an insecure cookie in the victim’s browser. This cookie is treated as a Host- or Secure-cookie by PHP applications...
Astra Linux – Vulnerability in Python 3.11
It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...
ROOT-OS-DEBIAN-11-CVE-2026-11972 CVE-2026-11972 in python3.9 - Patched by Root
Root has patched CVE-2026-11972 in the python3.9 package for Root:Debian:11. Multiple fixed versions available...
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...
CLSA-2026-1788560406 TuxCare security update for ws (3 CVEs)
TuxCare rebuilt ws to address 3 CVEs. Fixed in 8.13.0-tuxcare.1...
Fedora 44 : GitPython (2026-32054fb87a)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32054fb87a advisory. Update to 3.1.60. Fixes GHSA-g5vv-9gxw-82hx, GHSA-whh4-5q6c-9v3x, and GHSA-239g-whfq-7xj9. Tenable has extracted the preceding description block directly fro...
Malicious code in @hd-team/app-dnpkg-three (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14574 Malicious code in @hd-team/app-dnpkg-three (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview @hd-team/app-dnpkg-three is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
ROOT-OS-DEBIAN-12-CVE-2025-5372 CVE-2025-5372 in libssh - Patched by Root
Root has patched CVE-2025-5372 in the libssh package for Root:Debian:12. Multiple fixed versions available...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Bail out from dwc3gadgetexit if dwc-gadget is NULL. There exists a possible scenario in which dwc3gadgetinit may fail: during the switch between peripheral and host modes in dwc3setmode, and if a pending gadget...
BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...
Exploit for CVE-2026-60004
CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea di...
EUVD-2026-42933
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket...
CLEANSTART-2026-FZ96699 Security fixes in postgres-operator 1.13.0-r1
Package postgres-operator version 1.13.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-5cgq-3rg8-m6cv, ghsa-rm3j-f69w-wqmq...
ROOT-OS-ALPINE-323-CVE-2026-11586 CVE-2026-11586 in curl - Patched by Root
Root has patched CVE-2026-11586 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...