85190 matches found
CVE-2026-48958
creationtimestamp| type| source ---|---|--- 2026-07-07 20:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ilqv6ms2z 2026-07-08 14:15:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
SummaryA Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...
PYSEC-2026-1668 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Summary A Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...
PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization
Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...
PYSEC-2026-1950 Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
A critical deserialization vulnerability exists in Tendenci Helpdesk module NOTE, by default, Helpdesk is NOT enabled, affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution RCE by an authenticated user with staff security level due to using Python's pickle...
PYSEC-2026-2051 Weblate command-line client susceptible to SSL verification skip
Impact The SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. References This issue was reported to us by wh1zee via HackerOne...
Weblate command-line client susceptible to SSL verification skip
ImpactThe SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 WorkaroundsAvoid using untrusted wlc configurations, as that might cause insecure connections. ReferencesThis issue was reported to us by wh1zee via HackerOne...
epynn (>=1.2.0, <=1.2.13), jupyter-web-report (0.2.1) +1 more potentially affected by CVE-2025-53000 via nbconvert (5.4.1)
nbconvert PYPI version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - epynn =1.2.0, =0.1.7, =0.2.0 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...
PYSEC-2026-1623 mcp-server-git has missing path validation when using --repository flag
In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repopath arguments in subsequent tool calls were actually within that configured path. This could allow tool calls t...
PYSEC-2026-1504 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Description Label Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attack...
MAL-2026-7446 Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7269 Malicious code in elf-stats-merry-fir-592 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7247 Malicious code in cookie-parseflow (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7136 Malicious code in angulamjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9753 Malicious code in zrgvsearchf663 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9698 Malicious code in zq2706 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9627 Malicious code in zlam_hjand (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9392 Malicious code in wmwk3bothab (RubyGems)
--- -= Per source details. Do not edit below this line.=-...