15893 matches found
MAL-2026-2716 Malicious code in @needl-ai/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1b98ae2755d0fd7d61bc3dfd378dc1bad2eadf7ef0033ba66bbf1383a711e5c The package @needl-ai/common was found to contain malicious code. Source: ossf-package-analysis...
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
...
LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories
Large language models LLMs are increasingly embedded in open-source software OSS ecosystems, creating complex interactions among natural language prompts, probabilistic model outputs, and execution-capable components. However, it remains unclear whether traditional vulnerability disclosure...
CVE-2026-5585: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/taskmanager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit ha...
CVE-2016-20052
creationtimestamp| type| source ---|---|--- 2026-04-04 15:25:45+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mioka3avcd2o 2026-04-04 15:40:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miokztck4i2j 2026-04-14 20:07:08+00:00| seen|...
BELL-CVE-2026-31396
Bulletin has no description...
BELL-CVE-2026-31402
Bulletin has no description...
Exploit for OS Command Injection in Php
CVE-2024-4577 Python Exploit Toolkit A Python toolkit for exp...
DEBIAN-CVE-2026-23472
In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handletx for PORTUNKNOWN uartwriteroom and uartwrite behave inconsistently when xmitbuf is NULL which happens for PORTUNKNOWN ports that were never properly initialized: - uartwriteroom returns...
DEBIAN-CVE-2026-23459
In the Linux kernel, the following vulnerability has been resolved: iptunnel: adapt iptunnelxmitstats to NETDEVPCPUSTATDSTATS Blamed commits forgot that vxlan/geneve use udptunnel6xmitskb which call iptunnelxmitstats. iptunnelxmitstats was assuming tunnels were only using NETDEVPCPUSTATTSTATS...
ppg-common (>=1.2.0, <=1.67.0) potentially affected by CVE-2026-35536 via tornado (4.5.0)
tornado PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - ppg-common =1.2.0, =1.67.0 Source cves: CVE-2026-35536 Source advisory: OSV:GHSA-FQWM-6JPJ-5WXC...
ppg-common (>=1.2.0, <=1.67.0) potentially affected by CVE-2026-35536 via tornado (4.5.0)
tornado PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - ppg-common =1.2.0, =1.67.0 Source cves: CVE-2026-35536 Source advisory: OSV:PYSEC-2026-2287...
CVE-2026-34397
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...
CVE-2026-34610
The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lcx509extractnamesegment casts sizet vlen to uint8t when storing the Common Name CN length. An attacker who crafts a certificate with CN = victim's CN +...
CVE-2026-34610
The CVE affects leancrypto's PQC-focused crypto library. Before 1.7.1, lc_x509_extract_name_segment() truncates size_t vlen to uint8_t for CN length, allowing an attacker to craft a certificate whose CN impersonates the victim’s CN during PKCS#7 verification, certificate chain matching, and code ...
CVE-2026-34610
The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lcx509extractnamesegment casts sizet vlen to uint8t when storing the Common Name CN length. An attacker who crafts a certificate with CN = victim's CN +...
CVE-2026-34610 leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation
The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lcx509extractnamesegment casts sizet vlen to uint8t when storing the Common Name CN length. An attacker who crafts a certificate with CN = victim's CN +...
CVE-2019-11340
creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...
The State of Trusted Open Source Report
In December 2025, we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open source consumption across our catalog of container image projects, versions, images, language libraries, and builds. These insights shed light on...