Multiple vulnerabilities in Fluentd
Fluentd provided by Fluentd Project contains multiple vulnerabilities.
Advisories tracked
21,650
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,793
Sources online
24
Last sync
4H AGO
Microsoft Edge Remote Code Execution Vulnerability
Vulnerability in HAProxy (June 29, 2026)
A vulnerability has been discovered in HAProxy. It allows an attacker to cause remote denial of service.
Multiple vulnerabilities in Microsoft Edge (June 29, 2026)
Multiple vulnerabilities have been discovered in Microsoft Edge. They allow an attacker to cause remote arbitrary code execution and an unspecified security issue by the vendor.
Multiple vulnerabilities in KeyCloak (June 29, 2026)
Multiple vulnerabilities have been discovered in KeyCloak. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and data confidentiality breaches.
Multiple vulnerabilities in Microsoft Azure Linux (June 29, 2026)
Multiple vulnerabilities have been discovered in Microsoft Azure Linux. They allow an attacker to cause an unspecified security issue by the vendor.
Multiple vulnerabilities in Stormshield Management Center (June 29, 2026)
Multiple vulnerabilities have been discovered in Stormshield Management Center. They allow an attacker to cause remote arbitrary code execution, data confidentiality breaches, and data integrity breaches.
Multiple vulnerabilities in Mattermost Server (June 29, 2026)
Multiple vulnerabilities have been discovered in Mattermost Server. They allow an attacker to cause an unspecified security issue by the vendor.
CVE-2026-48558: SimpleHelp Authentication Bypass Vulnerability
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauth…
DSA-6372-1 tor - security update
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6372-1
DSA-6373-1 lxd - security update
Multiple security issues were discovered in LXD, a system container and virtual machine manager, which could result in a bypass of security restrictions or the execution of arbitrary commands. https://security-tracker.debian.org/tracker/DSA-6373-1
GHSA-m34p-749j-x6m6: js-toml has silent type confusion via falsy-primitive duplicate-key bypass
Summary js-toml's interpreter checks whether a key already exists in a parser-built container with if (object[key]) instead of if (key in object). When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is sile…
GHSA-75mw-h36v-2jv7: Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Summary The HTML and RSS output handlers in dosagelib/events.py write user-controlled content (comic text and page URLs) directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlle…
GHSA-6q7j-xr26-3h2c: Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
Summary The ExpressionDepthLimit parser guard in Scriban does not actually stop parsing — it only logs a non-fatal error and lets recursive descent continue. As a result, a template containing a deeply nested expression (parentheses, array initializers, object initializers, or u…
GHSA-q6rr-fm2g-g5x8: Scriban: array * int (ScriptArray .TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx
Summary The array multiplication operator (array * integer) in Scriban allocates a result whose size is the product of the attacker-controlled integer and the array length, with no LoopLimit / LimitToString check and no overflow-safe arithmetic. A ~40-byte template forces a mult…
Google Chrome security advisory (AV26-634)
Serial number: AV26-634 Date: June 26, 2026 On June 25, 2026, Google published a security advisory to address vulnerabilities in the following product: Stable Channel Chrome for Desktop – versions prior to 149.0.7827.200/201 (Windows/Mac), and 149.0.7827.200 (Linux) The Cyber Cen…
Russian Intelligence Services Continue to Target Commercial Messaging Applications
CISA and the Federal Bureau of Investigation (FBI) issued an updated Public Service Announcement (PSA) warning of Russian Intelligence Services (RIS) cyber threat actors targeting commercial messaging applications in ongoing phishing campaigns. This PSA is an update to the March …
ExpressUpdate Agent for Windows improper access restriction on its named pipe
ExpressUpdate Agent for Windows provided by NEC Corporation configures its named pipe with an improper access restriction.
Google Chrome Multiple Vulnerabilities
Multiple vulnerabilities in the Red Hat Linux kernel (June 26, 2026)
Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities in the Debian Linux kernel (June 26, 2026)
Multiple vulnerabilities have been discovered in the Debian Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality, and denial of service.
Multiple vulnerabilities in IBM products (June 26, 2026)
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
DSA-6370-1 incus - security update
Several vulnerabilities were discovered in the Xorg X server, which may result in privilege escalation if the X server is running privileged. https://security-tracker.debian.org/tracker/DSA-6370-1
Multiple vulnerabilities in Google Chrome (June 26, 2026)
Multiple vulnerabilities have been discovered in Google Chrome. They allow an attacker to cause an unspecified security issue by the vendor.
Multiple vulnerabilities in Asterisk (June 26, 2026)
Multiple vulnerabilities have been discovered in Asterisk. Some of them allow an attacker to cause remote denial of service, a breach of data integrity, and a security policy bypass.
Multiple vulnerabilities in the Ubuntu Linux kernel (June 26, 2026)
Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality, and a security policy bypass.
Multiple vulnerabilities in Tenable Nessus (June 26, 2026)
Multiple vulnerabilities have been discovered in Tenable Nessus. They allow an attacker to cause SQL injection (SQLi).
Multiple vulnerabilities in the SUSE Linux kernel (June 26, 2026)
Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause a breach of data confidentiality, a breach of data integrity, and a security policy bypass.
GHSA-x527-x647-q7gg: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
GHSA-5cgq-3rg8-m6cv: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
GHSA-rm3j-f69w-wqmq: golang.org/x/crypto vulnerable to infinite loop on large channel writes
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent trunca…
GHSA-89gr-r52h-f8rx: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the…
GHSA-w879-237q-wc7r: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clien…
GHSA-vgwf-h737-ff37: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now …
GHSA-qpw4-5x99-6vjp: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state …
GHSA-78mq-xcr3-xm33: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
GHSA-45gg-vh54-h5m9: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with Par…
GHSA-q4h4-gmj2-qvw2: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
GHSA-f5wc-c3c7-36mc: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now…
GHSA-jppx-rxg9-jmrx: golang.org/x/crypto doesn't enforce invoking key constraints
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns a…
GHSA-9m57-25v3-79x9: golang.org/x/crypto: Invoking pathological inputs can lead to client panic
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Cisco security advisory (AV26-547) – Update 1
Serial number: AV26-547 Date: June 3, 2026 Updated: June 25, 2026 On June 3, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following: Cisco Unified Communications Manager (CM) Release 14 – version…
GHSA-w39p-vh2g-g8g5: LangGraph SDK has unsafe URL path construction
Summary langgraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resultin…
HPE security advisory (AV26-633)
Serial number: AV26-633 Date: June 25, 2026 On June 25, 2026, HPE published a security advisory to address a critical vulnerability in the following product: HPE Telco Service Orchestrator – versions prior to v5.6.1 The Cyber Centre encourages users and administrators to review t…
Cisco Finesse Remote File Inclusion Vulnerability
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks. This vulnerability is due to insufficient validation of use…
Schneider Electric PowerLogic P7
View CSAF Summary Schneider Electric is aware of a vulnerability in its PowerLogic™ P7 product. The PowerLogic™ P7 is a protection and control platform designed for complex and advanced electrical network applications. Failure to apply the remediation provided below may risk unau…
Delta Electronics DTM Soft
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. The following versions of Delta Electronics DTM Soft are affected: DTMSoft vers:all/* CVSS Vendor Equipment Vulnerabilities v3 7.8 Delta Electronics Delta Electronic…
H.VIEW HV-500S6 IP Camera
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code and upload malicious files to the affected device. The following versions of H.VIEW HV-500S6 IP Camera are affected: H.VIEW HV-500S6 IP Camera IPCAM_V4.06.88.25122…
Horner Automation Cscape
View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to disclose information and execute arbitrary code. The following versions of Horner Automation Cscape are affected: Cscape <10.2_SP3 CVSS Vendor Equipment Vulnerabilities v3 7.8 Horne…
pydicom pynetdicom Library
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthenticated attacker to write to arbitrary file paths. The following versions of pydicom pynetdicom Library are affected: pynetdicom >=v1.0.0|<v3.0.4 CVSS Vendor Equipment Vulnerabilities v3 9.1 py…