NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Summaryhydra.utils.instantiate resolves and calls Python objects from config. If anapplication passes untrusted config to instantiate, an attacker who controlstarget and its arguments can cause arbitrary code execution in the consumingprocess.Hydra is not a network service. Exploitation requires ...

PYSEC-2026-3840 GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Summary Repo.init forwards kwargs verbatim to git init with no unsafe-option guard and no allowunsafeoptions parameter. git init --template= copies /hooks/ into the new repo's .git/hooks, so an attacker-controlled template kwarg plants a hook that executes on the next git operation → arbitrary co...

ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-13745

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-42807

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINESSDK versions 2.10 through 2.12.2 allows attackers to cause a denial of service process crash or potentially execute arbitrary code. The bridge decoder bridgedecoder.c trusts the packet length fiel...

EUVD-2026-75361

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...

CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-13745

The Gemini CLI (prior to version 0.39.1 ) and the associated GitHub Action are vulnerable to arbitrary code execution . An unprivileged attacker can achieve this by tricking a victim into starting the CLI within an untrusted directory containing malicious .env files. These files can override GEMI...

CVE-2026-80351

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351

Apache Camel K is vulnerable to an eval injection vulnerability caused by improper neutralization of directives in dynamically evaluated Maven configuration. This flaw allows tenant-controlled repository content to influence code execution within the operator pod , potentially enabling tenants to...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...