merlin

Merlin Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go. Highlighted features: merlin-cli command line interface over gRPC to connect to the Merlin Server facilitating multi-user support Supported Agent C2 Protocols: http/1.1 clear-text, http/1.1 over...

kubesploit

Kubesploit Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent dedicated for containerized environments written in Golang and built on top of Merlin project by Russel Van Tuyl @Ne0nd0g. Our Motivation While researching Docker and Kubernetes, we noticed that...

[SECURITY] Fedora 45 Update: ocaml-merlin-5.8.1-2.fc45

Merlin is an assistant for editing OCaml code. It aims to provide the features available in modern IDEs: error reporting, auto completion, source browsing and much more. You should also install a package that integrates with your editor of choice, such as emacs-merlin or vim-merlin...

MPXJ: XXE Vulnerability in MerlinReader

ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

GHSA-5VVX-3H34-F3GJ MPXJ: XXE Vulnerability in MerlinReader

Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-64849 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...

XML External Entity (XXE) Injection

Overview mpxj is a Python wrapper for the MPXJ Java library for manipulating project files Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. ...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-3198 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-2659...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-4137 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2026-2734 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-2614 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-2614 Source advisory: OSV:PYSEC-2026-2...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2025-15031 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2025-14279 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2025-11201 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2025-11201 Source advisory: OSV:PYSEC-2026-1640...