CVE-2026-16051: Improper Control of Generation of Code

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

Important: Red Hat Security Advisory: OpenShift Virtualization v4.15 Images

Red Hat OpenShift Virtualization release v4.15 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035

The CVE-2026-73035 vulnerability affects npm-check-updates up to version 23.0.2. A terminal escape sequence injection flaw exists in dependency homepage/repo URL fields, allowing unfiltered control characters to be emitted to the terminal when using --format homepage or --format repo. This can en...

EUVD-2026-55804

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

MGASA-2026-0330 Updated php8.5 packages fix security vulnerabilities

Updated php 8.5 packages fix some security vulnerabilities. For details see the references...

Updated php8.5 packages fix security vulnerabilities

Updated php 8.5 packages fix some security vulnerabilities. For details see the references...

CVE-2026-68386 bpf, sockmap: Reject unhashed UDP sockets on sockmap update

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68386

The CVE concerns the Linux kernel’s BPF sockmap path. It describes a vulnerability where unhashed UDP sockets accepted by sockmap can have their refcount incremented via a BPF lookup, and if the socket becomes bound, the subsequent bpf_sk_release() may skip decreasing the refcount, leading to a m...

Exploit for Expression Language Injection in N8N

CVE-2026-65591 Name of the Vulnerable Software and Affected Ve...

Photon OS 5.0: Binutils PHSA-2025-5.0-91-0488

An update of the binutils package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0488. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69948

Name of the Vulnerable Software and Affected Versions npm-check-updates versions prior to 23.0.3 Description An issue exists where an attacker can embed arbitrary terminal control characters within the homepage or repository URL fields of a dependency's package.json file. When a developer execute...

CVE-2026-73035: Improper Neutralization of Escape, Meta, or Control Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

Photon OS 5.0: Apache PHSA-2023-5.0-91-0093

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0093. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Expat PHSA-2026-5.0-91-0756

An update of the expat package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0756. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Gstreamer PHSA-2025-5.0-91-0461

An update of the gstreamer package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0461. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...