223316 matches found
KB5120233: Windows Server 2025 Security Update (August 2026)
The remote Windows host is missing security update 5120233 or hotpatch 5120228. It is, therefore, affected by multiple vulnerabilities - Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-62815 - Stack-based buffer overflow in Windows DNS...
CVE-2026-72903
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...
CVE-2026-72903
Tabby (formerly Terminus) has a Windows path traversal issue tracked as CVE-2026-72903. In affected builds prior to 1.0.235, the SFTP flow preserves backslashes and relative traversal when handling filenames returned by a malicious SFTP server. Specifically, SFTPSession.readdir() and _makeFile() ...
CVE-2026-72903 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...
CVE-2021-34529
creationtimestamp| type| source ---|---|--- 2026-08-10 20:06:37+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3msqvm5ssu22r...
CVE-2021-34498
creationtimestamp| type| source ---|---|--- 2026-08-10 18:06:20+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3msqov3kmi42x...
CVE-2026-72898
creationtimestamp| type| source ---|---|--- 2026-08-10 18:04:27+00:00| seen| https://infosec.exchange/users/wdormann/statuses/117072531713464991 2026-08-10 18:04:38+00:00| seen| https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3msqorw2bpc22 2026-08-10 18:56:56+00:00| seen|...
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed,...
Malicious code in env-local (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...
Astra Linux – Vulnerability in imagemagick
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a 32-bit unsigned integer overflow in the XWD X Windows encoder, which could lead to an undersized heap buffer allocation. When writing an extremely...
CVE-2026-13133
LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...
CVE-2026-13133
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
DEBIAN-CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...
CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...
CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...
CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...
[SECURITY] Fedora 44 Update: mingw-glib2-2.88.3-1.fc44
MinGW Windows Glib2 library...
MAL-2026-13630 Malicious code in @rbx-ts/services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...
Malicious code in @rbx-ts/services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...
SUSE CVE-2026-19139
Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...