163983 matches found
CVE-2026-113869
A flaw was found in Thunderbird. When requesting a security device password, such as a smartcard PIN or Primary Password, while decrypting a Secure/Multipurpose Internet Mail Extensions S/MIME message, the message loading process can finish or be canceled while the prompt remains open. This...
CVE-2026-112943
A flaw was found in launch-editor. When running on Windows systems, the package fails to properly escape percent characters when passing arguments to the Windows command shell. If an environment variable contains malicious values, an attacker could exploit this behavior to achieve arbitrary code...
CVE-2026-113679
A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly Wasm shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded...
CVE-2026-110858
A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution on the host system. The issue occurs because the Remote.pull function inspects only keyword arguments for unsafe command options and fails to validate positional repository reference...
CVE-2025-71436
A flaw was found in raptor2. The library improperly handles language tag lengths when parsing RDF Resource Description Framework documents, truncating lengths that exceed 255 bytes. A remote attacker can exploit this vulnerability by supplying a specially crafted document with an overly long...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the seed mechanism's console script launcher rewriting logic in pipinvoke.py when a virtual environment is created on POSIX systems with an interpreter path containing spaces. The rewritelaunchers method rewrites...
kernel: ipv4: validate checksum_start before completing checksum
A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during...
CVE-2026-112094
A flaw was found in mxml. A remote attacker can exploit a use-after-free vulnerability by supplying specially crafted XML input processed by the mxmlloaddata function. This flaw can lead to memory corruption, causing a Denial of Service DoS through an application crash or potentially allowing...
CVE-2026-113709
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...
CVE-2026-100134
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
kernel: ipv4: validate checksum_start before completing checksum
A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via the FromAppData seed mechanism in src/virtualenv/seed/embed/viaappdata/viaappdata.py, when symlinkappdata is enabled against a transient temporary app-data store. In this configuration, virtualenv creates symlinks fro...
CVE-2026-113356
A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw race condition during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization...
Malicious code in semvver (PyPI)
Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes the response to a temporary path, and spawns it ...
MAL-2026-18104 Malicious code in semvver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...
Malicious code in semvver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...
CVE-2026-100134 Acrobat for Edge | Out-of-bounds Write (CWE-787)
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
EUVD-2026-105255
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2026-100134
Acrobat for Edge is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution in the context of the current user. Successful exploitation requires user interaction , specifically requiring a victim to open a malicious file. N...