PT-2026-117591

Summary UnTar. safe extractall — the hardening added for GHSA-mvwx-582f-56r7 — validates member names and symlink/hardlink targets, but never checks member types, and calls tarfile.extractall without a filter=. On Python : names/links only raise ArchiveError... tar.extractallpath, members, numeri...

PT-2026-108757

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/ec host cmd/backends/ec host cmd backend shi ite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-in msg and only afterwards checked the protocol version and the derived packet...

PT-2026-109187

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

Aiohttp HTTP client Host Certificate DOSS

The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-109154

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

Linux Distros Unpatched Vulnerability : CVE-2026-107675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersona...

PT-2026-108985

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.11.0 through 3.3.14 Argo CD versions 3.4.0 through 3.4.9 Argo CD versions 3.5.0 through 3.5.3 Argo CD versions 3.6.0-rc1 and earlier Description The Argo CD repo-server is subject to command injection when cloning, testing, ...

SUSE CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...

CVE-2025-12999

A flaw was found in openvsx-server. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on client machines through HTTP cache poisoning. The server generates download and verification URLs from untrusted proxy headers, such as X-Forwarded-Host, without...

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-107714 Mechanize sends credential headers to a different scheme or port after a redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

MAL-2026-17707 Malicious code in wie888r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b [email protected] ships a stub main index.js that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name d...

Malicious code in wie888r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b [email protected] ships a stub main index.js that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name d...

Malicious code in xblaxw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host...

MAL-2026-17708 Malicious code in xblaxw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host...

MAL-2026-17705 Malicious code in css-overscroll-contain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...

Malicious code in css-overscroll-contain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...

Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...