CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

GHSA-3CHG-M5W7-QFV5 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry...

PT-2026-67288

Name of the Vulnerable Software and Affected Versions Wazuh workflows versions prior to 44bf114 Description A shell injection issue exists in GitHub Actions where attackers can execute arbitrary commands by submitting pull requests containing crafted VERSION.json files. This occurs because shell...

CVE-2026-67322: Exposure of Sensitive Information to an Unauthorized Actor

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

PT-2026-88183

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rwj8-pgh3-r573. This link is maintained to preserve external references. Original Description GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone from. The caller-supplied...

ricerca-tesi — Updated!

thesis-research Research resources for cve-2026-7228 Tools VirtualBox installation Installation of VirtualBox: https://www.virtualbox.org/wiki/Downloads Windows 11 ISO installation https://www.microsoft.com/it-it/software-download/windows11 Linux distro installation: Lubuntu...

vulnerabilities are hidden in JFrog Artifactory

JFrog has addressed several vulnerabilities in JFrog Artifactory. The vulnerabilities concern various components of JFrog Artifactory. - There is a possibility of privilege escalation, as the system does not control the scope of tokens, allowing attackers to elevate their privileges. - Users with...

SUSE CVE-2026-8634

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit...

Malicious code in ml-shared (PyPI)

Source: kam193 4f4ae8fee891c54953efa7c796a605e700fc827131feff0243f0b3bc8bd6a260 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-ml-shared Reasons based on...

Malicious code in ml-fdbk-shared (PyPI)

Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-ml-shared Reasons based on...

EUVD-2026-51329

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications through drag-and-drop components. Additionally, it supports deep customization using Python to integrate...

JFrog Artifactory 7.146.x < 7.146.34 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

Malicious code in ml-data-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff7fbcc539a2758c962aa64220b3ec62668dbd4a248fb8910956eb64ab7bd3ba During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11201 Malicious code in ml-nps-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fed6e01148ede73fae9d01667807eb310434a9c801b9eb60f08141e34921fc85 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

envocabulary v1.0.4

envocabulary For every variable in your current shell, find the file and line that set it — or which subsystem direnv, launchd, terminal, SSH, system injected it. Plus a few static-file commands for the moment your shell config has sprawled across N files and backups and you've lost the plot. I...

MAL-2026-11202 Malicious code in ml-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a726ddb6cfd4ce7da05b1b8c75e896e38789aa418c71d4db76f499b5727cb3 setup.py defines a function named analytics that collects the installer's hostname, username, current working directory, and the entire process...

CVE-2026-12562

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...