77426 matches found
Alibaba Cloud Linux 3 : 0181: php:7.4 (ALINUX3-SA-2026:0181)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0181 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-6722: In PHP versions 8.2. before...
PT-2026-56993
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description The signup flow allows newly registered users to set the primary group id variable...
TencentOS Server 2: glibc (TSSA-2025:1030)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1030 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
Podman 1.8.1 < 5.8.4 / 6.0.0 Host Environment Variable Leak (GHSA-4hq8-gpf5-8p68)
The version of Podman installed on the remote host is prior to 5.8.4 / 6.0.0. It is, therefore, affected by an information disclosure vulnerability. - Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains an environment variable with just a...
Security update for openQA, os-autoinst (moderate)
openSUSE Security Update: Security update for openQA, os-autoinst Announcement ID: openSUSE-SU-2026:0235-1 Rating: moderate References: 1244139 1245378 1245379 1257852 1258632 1259005 1264376 Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE: 7.5...
Security update for transmission (moderate)
openSUSE Security Update: Security update for transmission Announcement ID: openSUSE-SU-2026:0237-1 Rating: moderate References: 1267404 Cross-References: CVE-2026-38978 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...
MAL-2026-10024 Malicious code in @wagni_bot/eth-agent (npm)
The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...
MAL-2026-10038 Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....
RHEL 8 : xorg-x11-server (RHSA-2026:36768)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36768 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...
RHEL 10 : xorg-x11-server-Xwayland (RHSA-2026:36798)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36798 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server:...
SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2802-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2802-1 advisory. This update for netty, netty-tcnative fixes the following issue This update for netty, netty-tcnative fixes th...
PT-2026-57002
Name of the Vulnerable Software and Affected Versions Cotonti Siena versions prior to 0.9.27 Description A cross-site request forgery CSRF issue exists where unauthenticated attackers can modify administrator configurations. This occurs because the admin.php config update handler does not invoke...
PT-2026-56883
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description The file upload path fails to apply the necessary write-access checks when the metadata.knowledge id variable is provided. This allows users with read-only permissions to bypass the security...
Alibaba Cloud Linux 3 : 0183: xorg-x11-server-Xwayland (ALINUX3-SA-2026:0183)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0183 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-50256: A stack-based buffer...
Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....
RHEL 8 : xorg-x11-server (RHSA-2026:36792)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36792 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...
RHEL 8 : xorg-x11-server (RHSA-2026:36791)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36791 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via improper handling of AuthorizedKeysFile path expansion in the authentication. An attacker can gain unauthorized access to files outside the intended authorized-keys directory by supplying a path containing a...
