LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

GHSA-V847-HXXW-3PXG PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...

CVE-2026-27141 affecting package ignition-flatcar for versions less than 2.22.0-2

CVE-2026-27141 affecting package ignition-flatcar for versions less than 2.22.0-2. A patched version of the package is available...

EUVD-2026-20497

Hono has incorrect IP matching in ipRestriction for IPv4-mapped IPv6 addresses...

CVE-2025-70298

GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmxparsetags function...

CVE-2021-31216

Siren Investigate before 11.1.1 contains a server side request forgery SSRF defect in the built-in image proxy route which is enabled by default. An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs...

EUVD-2021-18129

Malware in sbrugna...

EUVD-2023-26946

Malicious code in bioql PyPI...

EUVD-2023-35284

Malicious code in bioql PyPI...

EUVD-2023-35296

Malicious code in bioql PyPI...

EUVD-2024-42849

Malicious code in bioql PyPI...

EUVD-2023-35298

Malicious code in bioql PyPI...

EUVD-2023-35293

Malicious code in bioql PyPI...

EUVD-2023-35290

Malicious code in bioql PyPI...

EUVD-2023-35294

Malicious code in bioql PyPI...

EUVD-2023-35286

Malicious code in bioql PyPI...

EUVD-2023-35301

Malicious code in bioql PyPI...

CVE-2025-39809

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused...

PSF-2025-11

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives...