MAL-2026-8668 Malicious code in slncwszfib (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8523 Malicious code in rfetchh (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8449 Malicious code in proxytcf1f8d7b (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8420 Malicious code in pd131119hccc (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8008 Malicious code in lf295q5 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7923 Malicious code in lbfajkdltu (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7801 Malicious code in lambfetch003 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7693 Malicious code in g8249bfavd (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7595 Malicious code in chmid8500x532747 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

ydata cross-site scripting

A cross-site scripting XSS vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser...

ydata unsafe deserialization

Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded...

PYSEC-2026-2062 ydata unsafe deserialization

Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded...

TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`

ImpactThe UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program.pythonimport numpy as npimport tensorflow as tf id is not scalartf.rawops.UnbatchGradoriginalinput= tf.constant1,batchindex=tf.constant0,0,0 , ,...

SUSE CVE-2026-13959

Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

Wireshark parse_report_descriptor() DoS

The vulnerability of the parsereportdescriptor function in the USB HID protocol analyzer of Wireshark, a computer network traffic analyzer, is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

FreeBSD : xrdp -- multiple vulnerabilities (a3a34818-79a0-11f1-b295-98b78501ef2a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a3a34818-79a0-11f1-b295-98b78501ef2a advisory. xrdp projects reports: xrdp v0.10.6.1 fixes 10 vulnerabilities and 1 regression introduced by ...

GHSA-2W8R-9XJ7-69J5 mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the...

blockies (0.0.1), demosys-py (>=0.1.2, <=0.3.12) +17 more potentially affected by CVE-2026-54059 via pillow (4.0.0)

pillow PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - blockies 0.0.1 - demosys-py =0.1.2, =0.0.2, =1.6.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.0, =3.0.0 and more Source cves:...

CVE-2026-14800

A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public an...

PYSEC-2026-986 Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

Impact The macros that TensorFlow uses for writing assertions e.g., CHECKLT, CHECKGT, etc. have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Patches We have patched the issue in GitHub commit...