[SECURITY] Fedora 44 Update: cockpit-360.1-1.fc44

The Cockpit Web Console enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more...

[SECURITY] Fedora 44 Update: plasma-mobile-6.6.4-1.fc44

General UI components for Plasma Phone including shell, containment and apple ts...

[SECURITY] Fedora 44 Update: plasma-desktop-6.6.4-1.fc44

Plasma Desktop shell...

[SECURITY] Fedora 44 Update: layer-shell-qt-6.6.4-1.fc44

This component is meant for applications to be able to easily use clients based on wlr-layer-shell...

flotorch-core (>=2.8.1, <=2.10.0), hie-rag (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-41488 via langchain-openai (0.2.13)

langchain-openai PYPI version 0.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - flotorch-core =2.8.1, =0.1.0, =1.2.4, =0.4.1, =0.1.0, =0.2.7 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ...

ai-shell-agent (>=0.1.0, <=0.2.2), toolmate-lite (>=0.6.51, <=0.6.52) potentially affected by CVE-2026-41488 via langchain-openai (0.3.2)

langchain-openai PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - ai-shell-agent =0.1.0, =0.6.51, =0.6.52 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the spawn function. An attacker can execute arbitrary shell commands on the server and access sensitive environment variables, including API keys, authentication secrets, and database credentials, by...

Flowise: File Upload Validation Bypass in createAttachment

Summary In FlowiseAI, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious...

WWBN AVideo: RCE cause by clonesite plugin

Description Summary The cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input url parameter without proper sanitization. The input is directly concatenated into a wget command executed via exec, allowing command injection. An attacker can inje...

Command Injection

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Command Injection in the cloneServer.json.php endpoint of the CloneSite plugin, where user-controlled input is concatenated into a shell command without proper...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the validateScriptFileForShellBleed function. An attacker can cause the preflight analysis to inspect a different file than the one tha...

CVE-2026-6442

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent...

Updated cockpit-338 packages fix security vulnerability

Unauthenticated remote code execution due to ssh command-line argument injection. CVE-2026-4631...

Spawn Reverse Shell Session

From the current session, open a reverse TCP listener lhost:lport and run a platform-appropriate one-liner so the target connects back; the new socket is registered as a separate shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a second interactive shell session reverse TCP from...

Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks

A "novel" social engineering campaign has been observed abusing Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented Windows remote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and...

MAL-2026-2795 Malicious code in react-appfabric-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a524b70e3efe81a382327e73d51cabb650ed488156ac7dbe61d61fcbcff68f8 The package react-appfabric-shell was found to contain malicious code...

Malicious code in react-appfabric-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a524b70e3efe81a382327e73d51cabb650ed488156ac7dbe61d61fcbcff68f8 The package react-appfabric-shell was found to contain malicious code...

UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign

The Computer Emergencies Response Team of Ukraine CERT-UA has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and...

[SECURITY] Fedora 43 Update: NetworkManager-ssh-1.4.4-1.fc43

This package contains software for integrating VPN capabilities with the OpenSSH server with NetworkManager...

PT-2026-35326

Summary An arbitrary code execution vulnerability in the workspace runtime service allows any agent to execute shell commands on the server, exposing all environment variables including API keys, JWT secrets, and database credentials. Details A malicious skill can instruct the agent to exploit th...