MAL-2026-8811 Malicious code in sm8255oilg (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slresultxyz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8611 Malicious code in sgjcvwjwwo (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8607 Malicious code in sghrlhoxql (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8517 Malicious code in rfetchb (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8329 Malicious code in oaipvtpwpldhz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8321 Malicious code in oaipphbsbxqgw (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7984 Malicious code in lchcbtgamir (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7772 Malicious code in hwc4v (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7738 Malicious code in hgpathr5 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7655 Malicious code in eiljtiiahbuj (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in chmid8330x616863 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-2032 Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

Impact Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. T...

PYSEC-2026-1718 OMERO.web must check that the JSONP callback is a valid function

Background There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is /webclient/imgData/.... As we only really use these endpoints with jQuery's own callback name generation ^1 it is quite...

PYSEC-2026-2075 Information disclosure in AccessControl

Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

PYSEC-2026-1963 TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

Impact When the parameter summarize of tf.rawops.Print is zero, the new method SummarizeArray will reference to a nullptr, leading to a seg fault. python import tensorflow as tf tf.rawops.Printinput = tf.constant1, 1, 1, 1,dtype=tf.int32, data = False, False, False, False, False, False, False,...

PYSEC-2026-1959 TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

Impact If the parameter indices for DynamicStitch does not match the shape of the parameter data, it can trigger an stack OOB read. python import tensorflow as tf func = tf.rawops.DynamicStitch para='indices': 0xdeadbeef, 405, 519, 758, 1015, 'data': 110.27793884277344, 120.29475402832031,...

PYSEC-2026-967 TensorFlow has Segfault in Bincount with XLA

Impact When running with XLA, tf.rawops.Bincount segfaults when given a parameter weights that is neither the same shape as parameter arr nor a length-0 tensor. python import tensorflow as tf func = tf.rawops.Bincount para='arr': 6, 'size': 804, 'weights': 52, 351 @tf.functionjitcompile=True def...

PYSEC-2026-926 Path traversal in spotipy

Summary If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. Details The code Spotipy uses to parse URIs and URLs accepts user data too liberally which allows a malicious user to insert arbitrary characters...

PYSEC-2026-1035 `tf.raw_ops.Mfcc` crashes

Impact If ThreadUnsafeUnigramCandidateSampler is given input filterbankchannelcount greater than the allowed max size, TensorFlow will crash. python import tensorflow as tf tf.rawops.Mfcc spectrogram = 1.38, 6.32, 5.75, 9.51, samplerate = 2, upperfrequencylimit = 5.0, lowerfrequencylimit = 1.0,...