EUVD-2026-48420

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

EUVD-2026-48363

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false...

CVE-2026-65918

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fau...

PT-2026-64158

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description An improper authentication issue exists in Progress MOVEit Transfer, which may allow an attacker to bypass authentication mechanisms...

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. The payload length is read directly from the wire and trusted without validation. A bad actor can send a reserved frame with a payload length of up to...

ALPINE-CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

PT-2026-63417

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can respond ...

Insertion of Sensitive Information Into Sent Data

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via Git.polishurl in Repo.clonefrom and the stored-origin normalization path in git/repo/base.py. An attacker can mak...

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Summary Repo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from...

GHSA-WRF9-R3H7-7X5V Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Summary The POST /api/v1/repos/owner/repo/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commits made after the parent...

Command Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...

SUSE CVE-2026-64082

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

Linux Distros Unpatched Vulnerability : CVE-2026-49145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current...

CVE-2026-47134

creationtimestamp| type| source ---|---|--- 2026-07-20 22:13:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4cvvfytm2j...

EUVD-2026-46124

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

Malicious Package

Overview ModernWpfUI.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-12484

A flaw was found in Keras, specifically within the keras.layers.TorchModuleWrapper.fromconfig method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leadi...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

Malicious Package

Overview @gocortexio/npmgremlinbox-tpl-1-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...