yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. Details The fix for CVE-2024-38519 enforced an allowlist for file extensions, in orde...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2026-50023 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2026-50023 Source advisory: OSV:GHSA-C6MH-FPJC-4PR3...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2026-50023 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2026-50023 Source advisory: OSV:GHSA-C6MH-FPJC-4PR3...

scdlbot (0.15.0), vk-url-scraper (0.3.15) +1 more potentially affected by CVE-2026-50023 via yt-dlp (2023.2.17)

yt-dlp PYPI version 2023.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - scdlbot 0.15.0 - vk-url-scraper 0.3.15 - ytb-downloader 0.3.1 Source cves: CVE-2026-50023 Source advisory: OSV:GHSA-C6MH-FPJC-4PR3...

vk-url-scraper (0.3.30) potentially affected by CVE-2026-50023 via yt-dlp (2024.7.15.232803.dev0)

yt-dlp PYPI version 2024.7.15.232803.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper 0.3.30 Source cves: CVE-2026-50023 Source advisory: OSV:GHSA-C6MH-FPJC-4PR3...

CVE-2026-12425

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...

CVE-2026-48294

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...

CVE-2026-48776

CVE-2026-48776 affects LangGraph Python SDK (versions up to 0.3.14) and describes unsafe URL path construction from unsanitized caller-supplied identifiers in HTTP request paths. This can cause requests to target a different resource or resource type, enabling unintended access, modification, or ...

CVE-2026-48776

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

CVE-2026-12425

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...

CVE-2026-12425

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...

GHSA-G75F-G53V-794X

creationtimestamp| type| source ---|---|--- 2026-06-16 16:41:37+00:00| seen| https://gist.github.com/alon710/5922ad26f6aa39fcda791f945c3402e2...

Malicious code in chain-chai-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...

MAL-2026-5908 Malicious code in chain-chai-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...

Malicious code in uidai_reusable_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5875a720dc1cfc6e30a67b003fc43975fbef2e11352e715e19e55e54dd84ae67 On npm install, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the installer's hostname, OS username...

CVE-2026-48780

creationtimestamp| type| source ---|---|--- 2026-06-16 16:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mog67gafbm25 2026-06-16 18:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogf2rqlzg2c...

MAL-2026-5889 Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...

CVE-2026-12328

creationtimestamp| type| source ---|---|--- 2026-06-16 14:58:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mog2qgnwtj2x 2026-06-16 17:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogbl2aocw2f 2026-06-17 20:00:00+00:00| seen|...

CVE-2026-9507

creationtimestamp| type| source ---|---|--- 2026-06-16 14:53:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mog2hi73xp2v...

Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Summary nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname decodes the %xx sequences a classic decode-after-check / TOCTOU-style flaw, allowing ...