CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

Malicious Package

Overview pulleeelll is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-15969 CVE-2026-15969

SGLang contains an unauthenticated RCE in /loadloraadapterfromtensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads...

CVE-2026-15976 CVE-2026-15976

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /updateweightsfromdisk, where torch.load..., weightsonly=False fallback enables pickle deserialization of .bin files...

PT-2026-66630

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crafted IEC 60870-5-104 I-frame with TypeID 104 C TS NA 1 and an inflated object count causes the TestCommand getFromBuffer function to read one byte past the...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.29.1 Release.

Red Hat OpenShift Dev Spaces 3.29.1 has been released. Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on...

Eval Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Eval Injection via unsanitized input in the fromfullpath and createline functions. An attacker can execute arbitrary code at import time by supplying malicious schema extensions tha...

CVE-2026-57511

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

EUVD-2026-49996

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-57511

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

CVE-2026-51268

...

EUVD-2026-49866

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantlehost function parses untrusted host and URL input, and subsequent code uses clonefrom to copy parsed host, request host, extension and querystring segments into fixed heap...

Malicious Package

Overview @ornexus/neocortex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65879

The SP Page Builder Joomla extension by joomshaper.com is vulnerable to an unauthenticated mail relay in versions prior to 6.7.1 . This issue is caused by a hardcoded, product-wide secret that enables attackers to forge the "from" address of emails sent via web forms. No specific exploit links or...

Malicious Package

Overview gamified-trading-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...