CVE-2021-23383

CVE-2021-23383 El paquete handlebars anterior a la versión 4.7.7 es vulnerable a Contaminación de Prototipos al seleccionar ciertas opciones de compilación para compilar plantillas provenientes de una fuente no confiable...

CVE-2021-23369

CVE-2021-23369 Vulnerabilidad Handlebars CVE-2021-23369 pip install requests Ingrese la URL : Descripción de la Vulnerabilidad El paquete handlebars anterior a la versión 4.7.7 es vulnerable a la Ejecución Remota de Código RCE al seleccionar ciertas opciones de compilación para compilar plantilla...

Astra Linux – Vulnerability in OpenSSL

Issue Summary: Checking excessively long DH keys or parameters can be very slow. Impact Summary: Applications that use functions like DHcheck, DHcheckex, or EVPPKEYparamcheck to check DH keys or parameters may experience prolonged delays. If the keys or parameters are obtained from an untrusted...

Astra Linux – Vulnerability in OpenSSL

Issue summary: Generating excessively long X9.42 DH keys or checking overly long X9.42 DH keys or parameters can be very slow. Applications that use functions like DHgeneratekey to generate an X9.42 DH key may experience prolonged delays. Similarly, applications that use functions like...

Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the fact that functions from an unreliable controlled area can be enabled, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

EUVD-2026-72578

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

Linux Distros Unpatched Vulnerability : CVE-2026-33245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential...

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

MAL-2026-14040 Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

EUVD-2026-55930

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

K000162730: Handlebars JavaScript templating engine vulnerability CVE-2021-23383

Security Advisory Description The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. CVE-2021-23383 Impact There is no impact; F5 products are not affected by this vulnerability...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

GHSA-6XX4-9WP6-65P7 skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

SUSE CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the unstable RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the WCOW cache mount source selector, which resolves NTFS junctions in the cache mount source path outside the intended cache root. A user who can author a build run by the daemon can read arbitrary host files reachabl...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...