991877 matches found
GHSA-GF2J-7QWG-4F5X Improper Authentication in Keycloak
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...
GHSA-84Q7-P226-4X5W Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration with RFC2616 compliance enabled, contain an HTTP Request Smuggling Vulnerability that can result in cache poisoning...
DLA-1481-1 linux-4.9 - security update
Bulletin has no description...
GHSA-MF6W-45CF-QHMP Git-fastclone passes user modifiable strings directly to a shell command
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to cd and git clone commands in the library...
DLA-1400-1 tomcat7 - security update
Bulletin has no description...
DLA-1330-1 openssl - security update
Bulletin has no description...
GHSA-W7Q9-XR2X-WH7X delayed_job_web Cross-site Scripting vulnerability
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem versions 1.2.9 before 1.4.2. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attack...
GHSA-333X-9VGQ-V2J4 Directory Traversal in geddy
Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors. Proof of Concept http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd Recommendation Update geddy to version = 13.0.8...
DLA-1024-1 nginx - security update
Bulletin has no description...
DSA-3908-1 nginx - security update
Bulletin has no description...
DLA-996-1 tomcat7 - security update
Bulletin has no description...
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...
DLA-818-1 php5 - security update
Bulletin has no description...
CVE-2016-1551
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip...
CVE-2016-7555
The avireadheader function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure...
DSA-3362-1 qemu-kvm - security update
Bulletin has no description...
DSA-3187-1 icu - security update
Bulletin has no description...
DLA-71-1 apache2 - security update
Bulletin has no description...
DSA-2928-1 linux-2.6 - security update
Bulletin has no description...
DSA-2926-1 linux - security update
Bulletin has no description...
DSA-2583-1 iceweasel - several
Bulletin has no description...
DSA-2025-1 icedove - several vulnerabilities
Bulletin has no description...
DSA-380 xfree86 - buffer overflows, denial of service
Bulletin has no description...
ROOT-OS-UBUNTU-2404-CVE-2026-45970 CVE-2026-45970 in linux - Patched by Root
Root has patched CVE-2026-45970 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()`
Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via Error::context and then later calls Error::downcastmut on the returned Error. The flaw was corrected in commit 6e8c000 by revising how the mutable reference is...
MAL-2026-6210 Malicious code in @apexcraft/nano-key (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c46938b3634fb4de89ddf44b765e1c766c871a40fb31c54609c1b3526074e65c @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator README and repository metadata are copied from yiwen-ai/xid-ts, an unrelated...
RHSA-2026:23264 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
CLEANSTART-2026-PK19530 Security fixes for CVE-2022-29526, CVE-2025-47907, CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-68121, CVE-2026-24515, CVE-2026-25210, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-4f99-4q7p-p3gh applied in versions: 0.10-r0, 0.11-r0, 0.11-r2, 0.11-r3, 0.11-r4, 0.11-r5, 0.11-r6
Multiple security vulnerabilities affect the druid-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...
CGA-V64G-QQW2-H8H9
Bulletin has no description...
GHSA-FHQ3-2GF3-8F3J misp-modules has nsafe remote resource fetching in expansion
An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The htmltomarkdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally...
CGA-4CM4-PXM6-X3MP
Bulletin has no description...
CGA-497W-V44M-5Q6R
Bulletin has no description...
USN-7917-1 fonttools vulnerabilities
It was discovered that the subsetting module of fontTools was vulnerable to an XML External Entity XEE attack. An unauthenticated remote attacker could possibly use this issue to include arbitrary files from the file system or make web requests from the host system. This issue only affected Ubunt...
MAL-2025-191211 Malicious code in @dev-blinq/blinqioclient (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a1d417e283165e25dc75c9510f4bcdde80854ca5600090b4de220548e72ae1 The package @dev-blinq/blinqioclient was found to contain malicious code. Source: google-open-source-security...
GO-2025-3977 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
BIT-PYTHON-2025-0938 URL parser allowed square brackets in domain names
The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in...
BIT-JOOMLA-2022-27911 [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing 'JEXEC or die check' caused by the PSR12 changes...
GHSA-8FM5-GG2F-F66Q Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction
Summary A publisher on a publify application is able to perform a cross-site scripting attack on an administrator using the redirect functionality. Details A publisher on a publify application is able to perform a cross-site scripting attack on an administrator using the redirect functionality. T...
GHSA-2FH4-GPCH-VQV4 Duplicate Advisory: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w8jq-xcqf-f792. This link is maintained to preserve external references. Original Description picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file...
BIT-PASSENGER-2025-26803
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...
GHSA-F5W3-73H4-JPCM mongosh vulnerable to local privilege escalation
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\nodemodules. This issue affects mongosh prior to 2.3.0...
PYSEC-2025-7 Posts scraped data to IP address associated with other malware distribution attacks.
Published in 2021, the imblog package is a Python library that scrapes data from a blog page to an IP address associated with other malware distribution attacks...
UBUNTU-CVE-2025-26309
A memory leak has been identified in the parseSWFDEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file...
GHSA-F697-GM3H-XRF9 Apache HugeGraph-Server: Fixed JWT Token (Secret)
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue...
CVE-2024-50264 vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans During loopback communication, a dangling pointer can be created in vsk-trans, potentially leading to a Use-After-Free condition. This issue is resolved ...
GHSA-28P7-F6H6-3JH3 LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php
Summary A Reflected Cross-Site Scripting XSS vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "metric"...
GHSA-J945-C44V-97G6 MPXJ has a Potential Path Traversal Vulnerability
Impact The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. Patches The issue is addressed i...
GHSA-VFJ8-5PJ7-2F9G OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
Summary The login functionality contains a reflected cross-site scripting XSS vulnerability. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition Impact This issue may lead up to Remote Code Execution RCE...