112696 matches found
CLEANSTART-2026-SU44499 net/url package does not set a limit on the number of query parameters in a query
Multiple security vulnerabilities affect the promxy package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...
RHEL 9 : rhc (RHSA-2026:8322)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8322 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...
AlmaLinux 8 : grafana (ALSA-2026:7011)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7011 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the AlmaLinux securi...
ALSA-2026:8456 Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/url:...
RHEL 8 : rhc (RHSA-2026:8434)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8434 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2026-007184)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007184 advisory. Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vi...
RHEL 9 : rhc (RHSA-2026:8324)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8324 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...
PT-2026-37184
Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.4.6 Saltcorn versions prior to 1.5.6 Saltcorn versions prior to 1.6.0-beta.5 Description Saltcorn fails to properly validate the dest parameter during the post-login process. The is relative url function only block...
Linux Distros Unpatched Vulnerability : CVE-2026-5160
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validati...
PT-2026-33258
UDP Console provided by Arcserve contains an incorrectly specified destination in a communication channel vulnerability. When a user configures an activation server hostname of the affected product to a dummy URL, the product may unintentionally communicate with the dummy domain, causing...
Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/url:...
D-Link DI-8003 Buffer Overflow Vulnerability (CNVD-2026-17643)
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability that originates from improper handling of the name parameter in the /urlgroup.asp endpoint, which can be exploited by an attacker to cause a denial of service...
D-Link DI-8003 Buffer Overflow Vulnerability (CNVD-2026-17648)
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability that originates from improper handling of multiple parameters in the /urlrule.asp endpoint, which can be exploited by an attacker to cause a denial of service...
Malicious code in trgrip (npm)
trgrip is a malicious npm package that when imported downloads a C2 dropper from https://44.206.172.239:7443/direct/download/97900a0e-c691-483a-a988-97b76f205c0f and executes it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...
CVE-2026-34632
creationtimestamp| type| source ---|---|--- 2026-04-15 23:25:44+00:00| published-proof-of-concept| Telegram/M6EVzZe60-ZK2hxHMbXVzi0icuKFKnAtI2GiQ0rZVKguBtE 2026-04-22 15:30:05+00:00| seen| https://infosec.place/objects/e937704a-fd88-4421-b9d6-cdadb714a102...
MAL-2026-2906 Malicious code in swplayer-react-sl (npm)
swplayer-react-sl is a malicious npm package that when imported downloads a C2 dropper from https://coingecko-liard.vercel.app and executes it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb25be00997a0e21d0d5337b89729fe6c3a99c9364f8a46d4b2e2a828e845f54 The...
Malicious code in swplayer-react-sl (npm)
swplayer-react-sl is a malicious npm package that when imported downloads a C2 dropper from https://coingecko-liard.vercel.app and executes it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb25be00997a0e21d0d5337b89729fe6c3a99c9364f8a46d4b2e2a828e845f54 The...
CVE-2026-6384
creationtimestamp| type| source ---|---|--- 2026-04-15 22:32:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkx7q2ru72k 2026-04-15 23:27:13+00:00| seen| Telegram/BTRiP8nJHP-5om9x2gw2G6e9UIMxwZAfdQggaCph1qz04g...
Server-side Request Forgery (SSRF)
Overview processwire/processwire is a CMS/CMF. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Add Module From URL process. An attacker can access internal network resources and sensitive endpoints by supplying arbitrary URLs to the module download...