Linux Distros Unpatched Vulnerability : CVE-2026-44228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS...

Linux Distros Unpatched Vulnerability : CVE-2026-63317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5...

Eval Injection

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Eval Injection via the main process in collocations.py when command-line arguments are passed directly to the eval function without proper...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the defaultContentParameterDecoder function. An attacker can cause the application to crash or abort request processing by sending a crafted HTTP request that targets an OpenAPI operation with a content...

EUVD-2026-48362

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve path allows unauthenticated Slowloris denial of service...

Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...

GHSA-GM3R-Q2WP-HW87 Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...

Shescape: Home-directory disclosure in assignment context on Unix with Dash

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...

GHSA-W4HW-QCX7-56PR Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...

EUVD-2026-48299

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure...

GHSA-29W2-FQ35-V728 AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...

Authentication Bypass by Assumed-Immutable Data

Overview Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the password change process when the stored password remains at its default value and the submitted password is not verified. An attacker can gain unauthorized access and set a new...