PYSEC-2026-2517 Home Assistant has stored XSS in Map-card through malicious device name

Summary An authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point The lines or the dots...

CVE-2026-22098

Various sensitive information such as passwords and charging card UIDs are written to log files...

CVE-2026-22098

Technical details about CVE-2026-22098 are not publicly available in the provided documents. The issue is described as sensitive information written to log files, but product/versions, impact specifics, and fixes are not specified. Monitor for updates.

EUVD-2026-43332

Various sensitive information such as passwords and charging card UIDs are written to log files...

CVE-2026-22098 Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files...

CVE-2026-22098 Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files...

PT-2026-57674

Various sensitive information such as passwords and charging card UIDs are written to log files...

CVE-2026-22098: Insertion of Sensitive Information into Log File

Various sensitive information such as passwords and charging card UIDs are written to log files...

toshsd MMC/SD/SDIO Card Driver Heap Buffer Overflow DoS

The vulnerability of the toshsdprobe function in the drivers/mmc/host/toshsd.c file of the MMC/SD/SDIO card driver for the Linux operating system is related to the lack of checking the return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

DEBIAN-CVE-2026-58266

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and edito...

How the Reddit and Discord false report scam steals accounts

A stranger messages you on Reddit. They say someone reported them, and the reporting account looks a lot like yours. Was it you? It wasn't. That's not really the point of the message. This version relies entirely on social engineering. There is no malware and no malicious links. It starts with a...

garmindb (3.2.8), metaflow-card-notebook (>=1.0.2, <=1.0.5) potentially affected by CVE-2025-53000 via nbconvert (6.4.1)

nbconvert PYPI version 6.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - garmindb 3.2.8 - metaflow-card-notebook =1.0.2, =1.0.5 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

image-crawl (0.1.0), metaflow-card-notebook (1.0.0) +2 more potentially affected by CVE-2025-53000 via nbconvert (6.1.0)

nbconvert PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - image-crawl 0.1.0 - metaflow-card-notebook 1.0.0 - omdenalore 0.2.10 - vimms 2.0.1 Source cves: CVE-2025-53000 Source advisory:...

SKOPS Card.get_model happily allows arbitrary code execution

SummaryThe Card class of skops, used for model documentation and sharing, allows arbitrary code execution. When a file other than .zip is provided to the Card class during instantiation, the internally invoked Card.getmodel method silently falls back to joblib without warning. Unlike the .skops...

PYSEC-2026-1925 SKOPS Card.get_model happily allows arbitrary code execution

Summary The Card class of skops, used for model documentation and sharing, allows arbitrary code execution. When a file other than .zip is provided to the Card class during instantiation, the internally invoked Card.getmodel method silently falls back to joblib without warning. Unlike the .skops...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +516 more potentially affected by CVE-2026-55379 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.8.0.dev20260511, =0.13.0.dev20261012 and more Source cves: CVE-2026-55379 Source advisory: SNYK:PYTHON-PILLOW-17824468...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +516 more potentially affected by CVE-2026-55380 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.8.0.dev20260511, =0.13.0.dev20261012 and more Source cves: CVE-2026-55380 Source advisory: OSV:PYSEC-2026-2256...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +516 more potentially affected by CVE-2026-55379 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.8.0.dev20260511, =0.13.0.dev20261012 and more Source cves: CVE-2026-55379 Source advisory: OSV:PYSEC-2026-2255...

PYSEC-2026-830 OpenStack Keystone allows information disclosure during account locking

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both...