1003619 matches found
MINI-2F95-Q3W5-JG24
Bulletin has no description...
MINI-8W8M-WH35-FFGQ
Bulletin has no description...
MINI-V7HJ-V88Q-RJ89
Bulletin has no description...
MINI-QQ88-3Q34-JM7V
Bulletin has no description...
MINI-7RX8-MVCG-2FP9
Bulletin has no description...
MINI-R5C8-8456-RRVM
Bulletin has no description...
MINI-8VWG-76GC-JH4J
Bulletin has no description...
MINI-7532-MMR7-Q557
Bulletin has no description...
MINI-WG2G-PW68-GXQ9
Bulletin has no description...
MINI-4MX2-H6R5-4X99
Bulletin has no description...
MINI-WQR5-GHX5-HJ7V
Bulletin has no description...
MINI-X33Q-F99V-R4XW
Bulletin has no description...
MINI-PQVV-VQXG-252F
Bulletin has no description...
MINI-P49C-C263-HRRJ
Bulletin has no description...
MINI-2HVM-56G4-8J2F
Bulletin has no description...
MINI-6HX5-73R5-8C3V
Bulletin has no description...
MINI-CRCW-97GR-4C89
Bulletin has no description...
MINI-GPF6-JJPC-GXW6
Bulletin has no description...
MINI-VG9F-88V6-GR7J
Bulletin has no description...
MINI-9P3W-8QHG-7F67
Bulletin has no description...
MINI-WMVW-6PWF-GVH6
Bulletin has no description...
MINI-FGP6-3W6X-6QWF
Bulletin has no description...
MINI-P4HG-GH5H-7GJ3
Bulletin has no description...
MINI-46CH-W7Q2-4GHF
Bulletin has no description...
MINI-GX69-56RX-7WG6
Bulletin has no description...
MINI-VFV6-54PM-W7FF
Bulletin has no description...
MINI-9PRH-96RW-R73G
Bulletin has no description...
MINI-W4FX-88X7-M9VQ
Bulletin has no description...
MINI-3RW8-R982-8V3J
Bulletin has no description...
RLSA-2026:52395 Important: postgresql security update
PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...
GHSA-8J49-MMCX-4MP5 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...
RLSA-2026:52396 Important: postgresql:12 security update
PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...
GHSA-3P54-567P-2WPR MobSF's CSRF checks not enforced after Django migration
Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
GHSA-95PX-34X5-P37H MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
GHSA-X768-8642-MMQ9 MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...
GHSA-Q4GH-4FFP-5CG8 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...
GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
GHSA-C9FV-CGMM-2WG7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...
MAL-2026-14129 Malicious code in plugin-react-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06f7ba466cb02448192971ad3767600e2830112b2b0a9640941e5152522f6d3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ROOT-APP-NPM-CVE-2026-33151 CVE-2026-33151 in socket.io-parser - Patched by Root
Root has patched CVE-2026-33151 in the socket.io-parser package for Root:npm. Multiple fixed versions available...
GHSA-W6X9-28JW-HQ7J MagicMirror: ssrf calendar .js
Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...
GHSA-998G-7V5W-CR7G MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
Vulnerability — Blind SSRF via CHECKARTICLEURL MagicMirror² newsfeed Analysis of the PoC exploit-ssrf-newsfeed.js. Target: newsfeed/nodehelper.js of MagicMirror², socket.io namespace /newsfeed. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-newsfeed.js | | Endpoi...
GHSA-W26R-FWG8-RCP3 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...