82721 matches found
PYSEC-2026-1668 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
Summary A Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...
PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization
Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...
PYSEC-2026-1950 Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
A critical deserialization vulnerability exists in Tendenci Helpdesk module NOTE, by default, Helpdesk is NOT enabled, affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution RCE by an authenticated user with staff security level due to using Python's pickle...
PYSEC-2026-2051 Weblate command-line client susceptible to SSL verification skip
Impact The SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. References This issue was reported to us by wh1zee via HackerOne...
PYSEC-2026-1623 mcp-server-git has missing path validation when using --repository flag
In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repopath arguments in subsequent tool calls were actually within that configured path. This could allow tool calls t...
PYSEC-2026-1504 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Description Label Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attack...
MAL-2026-7446 Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7269 Malicious code in elf-stats-merry-fir-592 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7247 Malicious code in cookie-parseflow (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7136 Malicious code in angulamjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9753 Malicious code in zrgvsearchf663 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9698 Malicious code in zq2706 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9627 Malicious code in zlam_hjand (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9392 Malicious code in wmwk3bothab (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9266 Malicious code in wandsdock7wre22janplus (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9258 Malicious code in wandsdock7wre22ddjan (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9013 Malicious code in tryc4bzz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8994 Malicious code in tinytestbkpsfsnykc (RubyGems)
--- -= Per source details. Do not edit below this line.=-...