ollama

ollama 此仓库是 Endor Labs EXPOSURE 的合成演示目标 。 当前状态刻意设计为易受攻击 （热状态）。EXPOSURE 将针对其报告热（HOT）判定。 跟踪的 CVE: CVE-2024-12886（无上游修复；仅通过补偿控制缓解）。 EXPOSURE 打开的演示 PR 将规范配置文件替换为加固变体，从而破坏攻击链—— 无需 升级易受攻击的依赖。 客户应用修复的工作量为一键完成 （审查 + 合并）。 此仓库非生产应用程序。它仅用于锚定 EXPOSURE“点击 → 实际 PR 打开”演示，针对真实 GitHub 仓库。...

invokeai

invokeai Este repositorio es un objetivo de demostración sintético para Endor Labs EXPOSURE. El estado actual es deliberadamente vulnerable HOT. EXPOSURE reportará un veredicto HOT en su contra. CVE rastreado: CVE-2024-10821 sin corrección ascendente; mitigado solo mediante un control...

http-server-node

http-server-node Este repositorio es un objetivo de demostración sintético para Endor Labs EXPOSURE. El estado actual es deliberadamente vulnerable HOT. EXPOSURE reportará un veredicto HOT contra él. CVE rastreado: CVE-2021-23797 sin corrección upstream; mitigado solo mediante un control...

node-prompt-here

node-prompt-here Este repositorio es un objetivo de demostración sintético para Endor Labs EXPOSURE. El estado actual es deliberadamente vulnerable HOT. EXPOSURE reportará un veredicto de HOT en su contra. CVE rastreado: CVE-2020-7602 sin parche oficial; mitigado solo mediante un control...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2, where its configuration file, known as grub.cfg, is created with the wrong permission set, allowing non-privileged users to read its contents. This represents a minor confidentiality issue, as those users could potentially access any encrypted passwords contained i...

Astra Linux – Vulnerability in Cpio

Debian’s cpio package contains a path traversal vulnerability. This issue was introduced by reverting the CVE-2015-1197 patches, which caused a regression in the --no-absolute-filenames option. Upstream has since provided a proper fix for this issue...

MGASA-2026-0337 Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links...

python3.12 security update

3.12.14-1.0.1 - Remove upstream URL reference 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227215 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193793...

CVE-2026-39245

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

ImpactVia a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython.It has been fixed for some Python versions. PatchesPatched...

Exploit for CVE-2026-53359

Januscape Hotfix — CVE-2026-53359 简体中文 Ze...

CVE-2026-12725

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply su...

Exploit for CVE-2026-46394

CVE-2026-46394 - HAXcms Git.php OS Command Injection CWE-78...

CLSA-2026-1777307149 libarchive: Fix of CVE-2021-31566

CVE-2021-31566: extend backport with upstream 8a1bd5c and ede459d2 to close the trailing-slash variant of the fixup-list symlink-follow attack...

Fedora 44 : forgejo (2026-a02182de40)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a02182de40 advisory. This is an upstream bug and security fix release. Please view the upstream release notes for more details. Tenable has extracted the preceding description...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002608 advisory. Linux Kernel version 3.18 to 4.16 incorrectly handles an SGIO ioctl on /dev/sg0 with dxferdirection=SGDXFERFROMDEV and an empty 6-byte cmdp. This may lead to copying...

Fedora 43 : docker-buildkit (2025-94f9b9b1b1)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-94f9b9b1b1 advisory. - Update to release v0.26.3 - Resolves CVE-2024-25621: rhbz2419004, rhbz2419033, rhbz2419427 - Upstream fix Tenable has extracted the preceding...

Fedora 42 : suricata (2025-0490389cb0)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0490389cb0 advisory. upstream bugfix/security release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : suricata (2025-a366512b23)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-a366512b23 advisory. Upstream security/bugfix release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : forgejo (2025-45da53cabc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-45da53cabc advisory. This is an upstream bug and security fix release. Please view the upstream release notes for more details. Tenable has extracted the preceding description...