PT-2026-44140

Name of the Vulnerable Software and Affected Versions symfony/dom-crawler affected versions not specified Description The Crawler::addXmlContent function in symfony/dom-crawler sets DOMDocument::$validateOnParse to true before calling loadXML. This action re-enables libxml's DTD subset processing...

PT-2026-42513

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A SQL injection issue exists in the incs/remotes.inc.php file. The application fails to sanitize values parsed from external GPS tracking service XML/JSON responses, specifically for...

CVE-2024-32983

creationtimestamp| type| source ---|---|--- 2026-05-20 22:02:44+00:00| seen| https://bsky.app/profile/tesaguri.fedibird.com.ap.brid.gy/post/3mmcvqb4beh22...

MAL-2026-4675 Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: apko, trufflehog, wolfictl, zot, cerbos, syft, pulumi-language-java, kubescape, pulumi-language-yaml, terragrunt, gitaly, melange, grafana-alloy, guac, bom, grype, src-fingerprint, gptscript, nfpm, teleport, kyverno, trivy, gitea, pulumi-language-dotnet, gitsign,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: apko, trufflehog, wolfictl, zot, cerbos, syft, pulumi-language-java, kubescape, pulumi-language-yaml, terragrunt, gitaly, melange, grafana-alloy, guac, bom, grype, src-fingerprint, gptscript, nfpm, teleport, kyverno, trivy, gitea, pulumi-language-dotnet, gitsign,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: apko, trufflehog, wolfictl, zot, cerbos, syft, pulumi-language-java, kubescape, pulumi-language-yaml, terragrunt, gitaly, melange, grafana-alloy, guac, bom, grype, src-fingerprint, gptscript, nfpm, teleport, kyverno, trivy, gitea, pulumi-language-dotnet, gitsign,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: apko, trufflehog, wolfictl, zot, cerbos, syft, pulumi-language-java, kubescape, pulumi-language-yaml, terragrunt, gitaly, melange, grafana-alloy, guac, bom, grype, src-fingerprint, gptscript, nfpm, teleport, kyverno, trivy, gitea, pulumi-language-dotnet, gitsign,...

Malicious code in @aswinsparky/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cceefd98563e2885501c896472471f2bb20b77103ad99c253775570cae6b4fe index.js line 11 issues a fetch to the hardcoded URL https://api.aswinsparky.qzz.io carrying values read from process.env. The destination is a...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: nfpm, nemo, gomplate-fips, argo-cd, gitlab-rails-ce, teleport, gitlab-runner-fips, crossplane-fips, trufflehog, melange, jfrog-cli, gitsign, argo-cd-fips, crossplane, pulumi-kubernetes-operator, terragrunt, kyverno, snyk-cli, gomplate, dagger, mapotf-fips,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: nfpm, nemo, gomplate-fips, argo-cd, gitlab-rails-ce, teleport, gitlab-runner-fips, crossplane-fips, trufflehog, melange, jfrog-cli, gitsign, argo-cd-fips, crossplane, pulumi-kubernetes-operator, terragrunt, kyverno, snyk-cli, gomplate, dagger, mapotf-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: nfpm, nemo, gomplate-fips, argo-cd, gitlab-rails-ce, teleport, gitlab-runner-fips, crossplane-fips, trufflehog, melange, jfrog-cli, gitsign, argo-cd-fips, crossplane, pulumi-kubernetes-operator, terragrunt, kyverno, snyk-cli, gomplate, dagger, mapotf-fips,...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

The CVE-2026-9101 entry describes a prototype pollution flaw in CSV parsing during import. The underlying issue can allow untrusted file paths (not arguments) to reach shell.openExternal after specific user actions, potentially enabling a limited form of “1-click” command execution. Documents do ...

Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

EUVD-2026-31127

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the Crawler::addXmlContent XML parsing logic. An attacker can read arbitrary local files by supplying crafted XML containing external entities, as validateOnParse re-enables DTD processing and...