melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

An attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set pipeline.uses to a value containing ../ sequences or an absolute path. The Compiled.compilePipeline function in pkg/build/compile.go passed uses...

CVE-2026-6859

A flaw was found in InstructLab. The linuxtrain.py script hardcodes trustremotecode=True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run ilab train/download/generate with a specially crafted malicious model...

BuildReview2

BuildReview2 - Attack-Path-Driven Windows Host Review A rewri...

AZL-9359 CVE-2022-27385 for package mariadb is not applicable

This CVE either no longer is or was never applicable...

CVE-2026-30898 Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

An example of BashOperator in Airflow documentation suggested a way of passing dagrun.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advi...

EUVD-2026-23660

An example of BashOperator in Airflow documentation suggested a way of passing dagrun.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advi...

CVE-2026-30898

An example of BashOperator in Airflow documentation suggested a way of passing dagrun.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advi...

CVE-2026-30898

CVE-2026-30898 concerns Apache Airflow where BashOperator usage documented in DAGs could pass dag_run.conf unsafely, enabling UI user privileges to execute code on workers. The issue arises from an example that could escalate privileges via shell injection-like behavior. The connected OSV entry c...

Enclawed: A Configurable, Sector-Neutral Hardening Framework for Single-User AI Assistant Gateways

We present enclawed, a hard-fork hardening framework built on top of the OpenClaw single-user personal artificial intelligence AI assistant gateway. enclawed targets deployments that need attestable peer trust, deny-by-default external connectivity, signed-module loading, and a tamper-evident aud...

PT-2026-33592

Name of the Vulnerable Software and Affected Versions Apache Airflow affected versions not specified Description An example of BashOperator in the documentation suggested a method of passing dag run.conf that allows unsanitized user input to be used. This can lead to a privilege escalation where ...

Malicious code in aca-review-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4019ca27647236621668ae5e45dd104c23d60ad5b64fd5179ad09efda40cc345 The package aca-review-apps was found to contain malicious code...

MAL-2026-2720 Malicious code in aca-review-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4019ca27647236621668ae5e45dd104c23d60ad5b64fd5179ad09efda40cc345 The package aca-review-apps was found to contain malicious code...

CVE-2026-26172

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:06:26+00:00| seen| Telegram/wMbMg2IIpe8qhH2P3K3O8ZiALd1adi8IR8v6NfGdxJbbfVA 2026-04-14 20:06:51+00:00| seen|...

CVE-2026-32083

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:11:39+00:00| seen| Telegram/djZ9N7bW9hvcR6MREjAY7uHiew4UYZZodIq6KPli6BHGYE 2026-04-14 20:11:45+00:00| seen|...

CVE-2026-32090

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:09+00:00| seen| Telegram/oEQn8vGzt9amdZwPj0LpHOqAegFTLvvnHRc5FBkCf3mZpAs 2026-04-14 20:12:17+00:00| seen|...

CVE-2026-32150

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:38+00:00| seen| Telegram/0ODkGIa-D2QGD1BPk8sJ-oSAmbPDR-HrUk95WksgYsZgcR0 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-32152

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:12:38+00:00| seen| Telegram/0ODkGIa-D2QGD1BPk8sJ-oSAmbPDR-HrUk95WksgYsZgcR0 2026-04-15 06:53:38+00:00| seen|...

CVE-2026-32081

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-15 06:53:38+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0119...

CVE-2026-32214

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-15 06:53:38+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0119...

CVE-2026-27925

creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-15 06:53:38+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0119...