OPENSUSE-SU-2026:20993-1 Security update for python-pip

This update for python-pip fixes the following issue - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite bsc1266669...

LDAP Injection

Apache Shiro is vulnerable to LDAP Injection. The vulnerability is due to improper neutralization of user-supplied input in the DefaultLdapRealm class, where usernames are concatenated directly into LDAP Distinguished Name DN templates without escaping RFC 2253 special characters. This allows...

MAL-2026-6238 Malicious code in atlasora-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5 package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https, fs, os, and childprocess;...

Ubuntu 16.04 LTS : Dolibarr vulnerability (USN-8448-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8448-1 advisory. It was discovered that Dolibarr incorrectly handled user-supplied database name values during installation. A remote attacker could possibly use this issue to...

External Control of File Name or Path

Overview network-ai is an AI agent orchestration framework for TypeScript/Node.js - 29 adapters LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Compu Affected version...

OpenBao: LDAPi ldaputil (wrong escape func)

Description Component sdk/helper/ldaputil/client.go — the shared LDAP utility library used by both the LDAP authentication backend and OpenLDAP secrets engine to construct LDAP search filters and bind DNs. Root Cause The LDAP utility contains a function selection error that causes incorrect...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getflowbyidorendpointname function. An attacker can access and execute flows belonging to other users, potentially exposing sensitive data and consuming resources, by specifying t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized input in the service name parameter when rendering exception messages. An attacker can execute arbitrary JavaScript or inject malicious HTML by supplying crafted input that is reflected in error...

GHSA-C29Q-5XM7-5P62 StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name is not sanitized and can contain HTML. Details There is a hardcoded list of allowed services in a switch statement inside EmbedServiceFactorynewFromName...

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid service name. The service name is not sanitized and can contain HTML. Details There is a hardcoded list of allowed services in a switch statement inside EmbedServiceFactorynewFromName...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through improper validation of DNSSEC responses and insufficient cache scoping. An attacker can inject and persist forged DNS records by providing unsigned or manipulated DNS answers...

symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

Description In symfony/ux-live-component, a component's server-side state is exposed to the browser as a set of props LiveProp-annotated properties. Props marked writable: true can be freely changed by the client. Read-only props are round-tripped to the browser and back, and their integrity is...

symfony/ux-live-component: XSS via attacker-controlled child component tag

Description Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON childrenid.tag parsed by LiveComponentSubscriber an...

GHSA-38X5-RCV4-XF7X symfony/ux-live-component: XSS via attacker-controlled child component tag

Description Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON childrenid.tag parsed by LiveComponentSubscriber an...

External Control of File Name or Path

Overview pontedilana/php-weasyprint is a PHP library allowing PDF generation from an url or a html page. Affected versions of this package are vulnerable to External Control of File Name or Path via the temporaryFiles array accessed by AbstractGenerator.php, which is publicly accessible. An...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the SessionID field used in constructing filesystem paths during the restore process. An attacker can overwrite arbitrary files on the victim's machine by crafting malicious checkpoint metadata...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fixed the device name memory leak. The device name allocated via kzalloc in initonemc is assigned to dev-initname, but it is never freed along with the normal removal path. The deviceregister function copies...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 patch 6 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path in DataSourceStream, which resolves control-plane-supplied DataSourceStream resolves the filename and environmentvariable fields without restriction. An attacker in a MitM position can access...

Malicious code in @qlab/component-intelligence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ad49caeee790003270d74c5b17a58d0cef6f04d881efe83b0f6c7e11515e934 package.json declares a preinstall hook "preinstall": "node index.js" that fires automatically on npm install. index.js requires os, dns, https,...