22596 matches found
Photon OS 5.0: Python3 PHSA-2026-5.0-92-0911
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0911. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Python3 PHSA-2026-5.0-91-0850
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0850. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Python3 PHSA-2026-5.0-91-0882
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0882. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2026-18817
CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...
GHSA-MQ44-7P77-Q5H7 vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.12-sdk, datahub-ingestion-fips, py3-cassandra-medusa, kserve-models-web-app, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes-fips, kserve, dask-kubernetes, apache-beam-python-3.13-sdk, open-webui, puppygraph-python,...
CVE-2026-70478
Summary of CVE-2026-70478 (Flowise) : The unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is exposed via WHITELIST_URLS and decrypts the stored credential to perform an OAuth token refresh, returning a new access_token in the response. An attacker with a valid creden...
CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...
CVE-2026-70474
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
CVE-2026-66300
SNOMED International Snowstorm has a reflected XSS vulnerability in the Web Route redirection feature. An attacker can inject arbitrary JavaScript that executes when a user visits a crafted link. Affected software/version details are not enumerated in this summary beyond Snowstorm; the vulnerabil...
CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...
github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers
A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service DoS condition where the affected server or clien...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.7 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.2-0.2.hum1 aarch64, x8664 prometheus3.13-3.13.2-0.2.hum1.src src Security Fixes: prometheus3.13: CVE-2026-69153...
EUVD-2026-52751
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...
CLSA-2026-1785727932 TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 33 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.17.2-tuxcare.2...
CLSA-2026-1784769545 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.1...
CLSA-2026-1784683086 TuxCare security update for shell-quote (3 CVEs)
TuxCare rebuilt shell-quote to address 3 CVEs. Fixed in 1.7.3-tuxcare.1...