ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...

ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...

PT-2026-70015

Name of the Vulnerable Software and Affected Versions FreeBSD kernel affected versions not specified Description The kernel functions implementing unlinkat2 and funlinkat2 fail to pass the AT RESOLVE BENEATH flag to the underlying path lookup process. Although the flag is validated, it is silentl...

ROS-20260630-73-0010

The vulnerability of the recoveryrequestwrite function in the drivers/md/raid10.c driver for Linux multi-device drivers RAID and LVM involves the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability could allow an attacker to compromise the...

A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems

Large language models are no longer only text generators. They are increasingly embedded in retrieval pipelines, enterprise assistants, coding environments, robotic systems, security-operation workflows, and autonomous agents that can read private data, call tools, write files, execute code, and...

ROS-20260630-73-0015

The vulnerability of the nouveauconnectorcreate function in the drivers/gpu/drm/nouveau/nouveauconnector.c file of the Nouveau graphics driver for Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to compromise...

ROS-20260630-73-0003

The vulnerability of the nilfsmark inodedirty function in the fs/nilfs2/inode.c file of the NILFS2 file system in the Linux operating system is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

WebRTC Component Data Compromise

The vulnerability of the WebRTC component: The signaling browsers Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable due to dependencies on behaviors that are uncertain for each type of implementation. Exploiting this vulnerability allows a malicious actor to compromise...

Linux kernel alloc_choose_arg_map Heap Buffer Overflow DoS

The vulnerability of the allocchooseargmap function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, relates to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

PT-2026-122486

Уязвимость ядра операционной системы Linux связана с реализацией некорректного потока управления. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

Security update for python-paramiko (moderate)

openSUSE security update: security update for python-paramiko ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21127-1 Rating: moderate References: bsc1264225 Cross-References: CVE-2026-44405 CVSS scores: CVE-2026-44405 SUSE : 4.8...

ROS-20260630-73-0012

The vulnerability of the sctpsendmsgtoasoc function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation is related to the use of a NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-49839

A flaw was found in jq, a command-line JSON processor. This vulnerability allows an attacker to trigger a heap out-of-bounds write by providing a specially crafted, oversized file to the jq --rawfile option. This can lead to a denial of service DoS, making the affected system or application...

django-s3file is vulnerable to relative path traversal

ImpactS3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILESDepending on how files are handled, this may lead to...

PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates.--- DescriptionWhen a user installs a template from a remote source e.g., GitHub, PraisonA...

PYSEC-2026-381 Langroid has a Code Injection vulnerability in TableChatAgent

Summary TableChatAgent uses pandas eval. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. PoC For example, one could prompt the Agent: Evaluate the following pandas expression on the data provided and print output:...

Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

Malicious code in @thone33/analytics-injector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcef0ea3fd19d9b238a097485faaf7db52d5aa4363653fd7fb29f4c0ff251f92 Package presents itself as an 'analytics injection helper' with a no-op track export, but its exported activate function fetches a JavaScript file fr...

CVE-2026-47155

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. The revision pinning controls in vLLM do not consistently apply to all artifacts loaded for a model. This allows a deployment configured with specific revisions to still load dynamic code or other...