@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...

CVE-2026-30239

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. Thi...

CVE-2026-31839

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered...

GlassWorm attack installs fake browser extension for surveillance

GlassWorm hides inside developer tools. Once it's in, it steals data, installs remote access malware, and even a fake browser extension to monitor activity. While it starts with developers, the impact can quickly spread. With stolen credentials, access tokens, and compromised tools, attackers can...

Improper Access Control

mautic/core is vulnerable to Improper Access Control. The vulnerability is due to missing enforcement of update settings restrictions, which allows a low-privileged user to install or remove arbitrary packages and execute malicious code for privilege escalation...

Arbitrary Code Injection

Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Arbitrary Code Injection via the systempackages handling in the Dockerfile generation and image command paths. An attacker can execute arbitrary shell commands during bentoml...

EUVD-2026-16513

BentoML has Dockerfile Command Injection via systempackages in bentofile.yaml...

GHSA-JFJG-VC52-WQVF BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary The docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since systempackages is semantically a list of OS package names data, users do not expect values to be interpreted as shell command...

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary The docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since systempackages is semantically a list of OS package names data, users do not expect values to be interpreted as shell command...

Linux Distros Unpatched Vulnerability : CVE-2026-4923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtrackin...

Important Photon OS Security Update - PHSA-2026-5.0-0796

Updates of 'binutils' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-33985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentiall...

Important Photon OS Security Update - PHSA-2026-5.0-90-0796

Updates of 'binutils' packages of Photon OS have been released...

PT-2026-28523

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37 Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does...

RHEL 10 : golang (RHSA-2026:5941)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5941 advisory. The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious...

@0xgraph/cli (>=0.0.1, <=0.2.1), @7speck/logger (>=1.0.2, <=1.0.3) +937 more potentially affected by CVE-2026-33532 via yaml (>=1.0.0, <=1.10.2)

yaml NPM version =1.0.0, =0.0.1, =1.0.2, =1.0.1, =0.0.1, =0.0.0-nightly-20240619-f62ef04, =1.6.3, =1.0.0, =0.9.1-pre.3, =0.11.1-pre.3, =0.6.1-pre.1, =1.0.0, =0.0.10, =2.9.1, =1.0.3, =0.6.6, =0.12.9 and more Source cves: CVE-2026-33532 Source advisory: SNYK:JS-YAML-15765520...

@aaquib/whatsasenanpm (1.3.5), @alexandersen01/sharepoint-mcp-server-better (0.3.23) +86 more potentially affected by CVE-2026-26832 via node-tesseract-ocr (>=0.1.0, <=2.2.1)

node-tesseract-ocr NPM version =0.1.0, =1.0.10, =0.0.1, =2.3.50-snapshot-1724322551764, =2.0.0, =0.0.1, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2026-26832 Source advisory: SNYK:JS-NODETESSERACTOCR-15874141...

GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data

Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and installing a remote access trojan RAT, which deploys an information-stealing Google Chrome extension masquerading as an offline version of...

GHSA-R46P-8F7G-VVVG vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails...

Linux Distros Unpatched Vulnerability : CVE-2026-4705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...