secscan

secscan !PyPI versionhttps://img.shields.io/pypi/v/secsca...

MAL-2026-3377 Malicious code in crypto-wallet-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1e40a039f63743a1d3c20fb312ecd2ecb1e47fe20c6787efa0a3f0f441ad5828 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - Th...

[SECURITY] Fedora 42 Update: openssl-3.2.6-4.fc42

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

OrchJail: Jailbreaking Tool-Calling Text-To-Image Agents by Orchestration-Guided Fuzzing

Tool-calling text-to-image T2I agents can plan and execute multi-step tool chains to accomplish complex generation and editing queries. However, this capability introduces a new safety attack surface: harmful outputs may arise from tool orchestration, where individually benign steps combine into...

PT-2026-39189

Name of the Vulnerable Software and Affected Versions n8n-MCP versions 2.18.7 through 2.50.1 Description An authenticated server-side request forgery SSRF issue exists affecting the webhook trigger tools, the n8n API client N8N API URL, and per-request URLs provided via the x-n8n-url header in...

CVE-2026-44694: Time-of-check Time-of-use (TOCTOU) Race Condition

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client N8NAPIURL, a...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8088 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8087 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8087 Source advisory: OSV:GHSA-H9RH-5FFH-H669...

CVE-2026-43581

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8088 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8088 Source advisory: OSV:PYSEC-2026-2156...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8087 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8087 Source advisory: OSV:PYSEC-2026-2155...

AZL-86430 CVE-2026-33814 affecting package azurelinux-image-tools for versions less than 1.4.0-2

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8086 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

lgblkb-tools (>=1.0.60, <=1.1.10) potentially affected by CVE-2026-8084 via gdal (2.4.3)

gdal PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - lgblkb-tools =1.0.60, =1.1.10 Source cves: CVE-2026-8084 Source advisory: OSV:PYSEC-2026-2153...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026)

Last week, there were 87 vulnerabilities disclosed in 198 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 61 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +5598 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-compression (>=4.2.0.alpha3, <=4.2.12.final)

io.netty:netty-codec-compression MAVEN version =4.2.0.alpha3, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42587 Source advisory: SNYK:JAVA-IONETTY-16438931...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

PT-2026-41621

libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c...

CVE-2026-41143: Improper Neutralization of Special Elements used in an SQL Command

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data'idfiche' value sourced from $POST'idfiche' is concatenated directly into a raw SQL query without any...