Rustfs log information leakage vulnerability

RustFS is a high-performance object storage system developed by RustFS. Versions 1.0.0-alpha.1 to 1.0.0-alpha.79 of RustFS contain a vulnerability related to log information leakage. This vulnerability arises from invalid RPC signatures, which allow the server to record shared HMAC keys,...

MiracleLinux 7 : procps-ng-3.3.10-17.el7.2 (AXSA:2018-3119:02)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3119:02 advisory. procps-ng, procps: Integer overflows leading to heap overflow in file2strvec CVE-2018-1124 procps-ng, procps: incorrect integer size in proc/alloc...

MiracleLinux 4 : patch-2.6-8.AXS4 (AXSA:2018-2973:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2018-2973:01 advisory. patch: Malicious patch files cause ed to execute arbitrary commands CVE-2018-1000156 Tenable has extracted the preceding description block directly from the...

node-tar path traversal vulnerability

node-tar is a software package for file compression/decompression developed by Isaacs. Versions of node-tar 7.5.2 and earlier contained a path traversal vulnerability. This vulnerability stemmed from uncleaned link paths, which could lead to arbitrary file overwriting and symbolic link poisoning...

MiracleLinux 7 : kernel-3.10.0-514.6.2.el7 (AXSA:2017-1335:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1335:02 advisory. The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the operating system:...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001663)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001663 advisory. Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the...

MiracleLinux 7 : ntp-4.2.6p5-25.0.1.el7.AXS7 (AXSA:2016-1181:02)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1181:02 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which...

RemoteMouse security vulnerability

Remote Mouse is a remote mouse application developed by the Remote Mouse company. Version 4.002 of Remote Mouse contains a security vulnerability. This vulnerability stems from the RemoteMouseService having a service path that is not enclosed in quotes, which may allow for the execution of...

CakePHP cross-site scripting vulnerabilities

CakePHP is an open-source web development framework based on the MVC architecture, created by the CAKE Foundation in the United States. This framework features flexible view caching, automatic generation of CRUD code, and other functionalities. Versions of CakePHP prior to 5.2.12 and 5.3.1...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000654)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000654 advisory. The x25negotiatefacilities function in net/x25/x25facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows...

PT-2026-7855

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.0 Description A remote code execution flaw exists in the Docker API deployment. The '/crawl' endpoint accepts a hooks parameter containing Python code that is processed using the exec function. Because the import...

CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...

CVE-2026-21906

An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker sending a specific ICMP packet through a GRE tunnel to cause the PFE to crash and restart. When PowerMode...

CVE-2026-21905

A Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the SIP application layer gateway ALG of Juniper Networks Junos OS on SRX Series and MX Series with MX-SPC3 or MS-MPC allows an unauthenticated network-based attacker sending specific SIP messages over TCP to crash the flow...

@burger-editor/client (>=4.0.0-alpha.43, <=4.0.0-alpha.51), @lapidist/design-lint (6.0.7) +4 more potentially affected by CVE-2025-15265 via svelte (>=5.46.0, <=5.46.3)

svelte NPM version =5.46.0, =4.0.0-alpha.43, =1.25.19, =0.2.1, =4.9.0, =4.10.0 Source cves: CVE-2025-15265 Source advisory: SNYK:JS-SVELTE-14988769...

CVE-2025-59959 Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash

An Untrusted Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service DoS. When the command 'show route detail' is executed, and at least one of th...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +213 more potentially affected by CVE-2026-23527 via h3 (>=1.0.1, <=1.15.4)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-23527 Source advisory: OSV:GHSA-MP2G-9VG9-F4CG...

GHSA-MP2G-9VG9-F4CG h3 v1 has Request Smuggling (TE.TE) issue

I was digging into h3 v1 specifically v1.15.4 and found a critical HTTP Request Smuggling vulnerability. Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. The...

CVE-2025-15265

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise. This...

CVE-2026-22774 devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse inpu...