django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-112394 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-112394 Source advisory: OSV:GHSA-4558-3H8R-V8XP...

cve-simulation-labs

CVE Simulation Lab Hands-on simulations for learning, r...

Exploit for CVE-2026-109618

php2shell-lab A reproducible, offline lab for safely anal...

pia-web-exploitation-lab

PIA Web Exploitation Lab ⚠️ ЭНЭ БОЛ ЗОРИУДААР ЭМЗЭГ СИСТ...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-112397 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-112397 Source advisory: OSV:GHSA-58R4-6RV3-GFH8...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-112896 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-112896 Source advisory: OSV:GHSA-PCHR-8J38-3X4P...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-112403 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-112403 Source advisory: OSV:GHSA-8G5G-8VMR-9782...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Data Intelligence Lab@HKU Vibe-Trading path traversal vulnerability

Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7 contain a path traversal vulnerability. This flaw stems from improper handling of paths in the LLM agent file reading tool; readdocument lacks proper sandbox checks, and the safeuserpath restriction can be bypassed. As a result,...

Data Intelligence Lab@HKU Vibe-Trading authorization issue vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is an authorization issue vulnerability. This arises because when APIAUTHKEY is not set, requireauth returns early, allowing unauthenticated attackers to access the FastAPI interface. They can post messages via...

Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

Malicious Package

Overview tailwindcss-effect-lab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

jcrodriguez-dis Virtual Programming Lab for Moodle Cross-Site Script Vulnerabilities

The jcrodriguez-dis Virtual Programming Lab for Moodle versions prior to 5.0.0 has a cross-site scripting vulnerability. This vulnerability stems from the unencoded filename1/filename2 parameters in the similarity/diff.php file. It may lead to reflective cross-site scripting attacks. Attackers ca...

Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

MAL-2026-18087 Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

sy0-701

SY0-701 Security+ Praxis-Lab Strukturierte, praxisorientierte...

Eiliko robot companion exposes private chats and can be hijacked

The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what...

CASIA-LMC-Lab Fast Segment Anything code injection vulnerability

CASIA-LMC-Lab Fast Segment Anything has a code injection vulnerability. This vulnerability stems from improper handling of the parameter imgsz/names/kptshape in the function session.getmodelmeta.custommetadatamap of the AutoBackend Model Loading component. This improper handling leads to incorrec...

Imprint Lab Medical-SAM-Adapter Code Injection Vulnerability

The Imprint Lab Medical-SAM-Adapter versions 0.1.0-alpha and 0.1.0 contain a code injection vulnerability. This vulnerability stems from the operation of the session.getmodelmeta.custommetadatamap function in the AutoBackend Model Loading component’s file...

Peppermint Lab Ticket Management System authorization issue vulnerability

The Peppermint Lab Ticket Management System versions 0.5.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; any authenticated user can create time entries and attachments under another user’s identity by providing their us...