Astra Linux – Vulnerability in faad2

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impacts, as the SM array is mishandled...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed an out-of-bounds shift in CalculateVMAndRowBytes. REASON When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dmllog2 returns an unexpected negative value: The shift exponent...

DRUPAL-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

PT-2026-84890

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

PT-2026-67705

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An authenticated staff user with reports module permissions can perform SQL injection via the reports/acquisitions stats.pl endpoint. The issue occurs in the calculate function, where...

PT-2026-67707

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/issues avg stats.pl script builds dynamic SQL within the calculate function by concatenating user-controlled request parameters directly into the query string. The Line and Column...

PT-2026-67708

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/bor issues top.pl script builds dynamic SQL within the calculate function by concatenating user-controlled request parameters directly into the query string. The Criteria parameter i...

PT-2026-67709

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The circulation statistics report in reports/issues stats.pl contains a flaw where the calculate function constructs SQL queries by concatenating user-controlled request parameters directly into...

PT-2026-67706

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/catalogue stats.pl script builds dynamic SQL within the calculate function by interpolating user-controlled Line and Column request parameters directly into identifier positions of t...

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...

CVE-2026-47391

PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...

EUVD-2026-46281

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

LoLLMS Code Injection vulnerability

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...

PYSEC-2026-1591 LoLLMS Code Injection vulnerability

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...

CVE-2026-14749

The CVE-2026-14749 entry concerns mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Vulnerability: the eval call in file application/pages/imba_calculator/calculate.php is affected; manipulating the argument mathematical_sentence enables code injection. Impact is remote, ...

CVE-2026-14749

A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file application/pages/imbacalculator/calculate.php. The manipulation of the argument mathematicalsentence leads to code injection. The attack is possible to ...

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

SummaryThe first-party PraisonAI A2A server example combines three behaviors into a remotely exploitable Critical chain:1. The example exposes an A2A server without configuring authtoken.2. The same example binds the server to 0.0.0.0.3. The example registers a calculateexpression tool implemente...

MAL-2026-6331 Malicious code in calculate-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a23ca03d834e21ee4ba3040e377b27097b9811e7d537e359c1b50b5aa15fdef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calculate-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a23ca03d834e21ee4ba3040e377b27097b9811e7d537e359c1b50b5aa15fdef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...