3319 matches found
MAL-2026-10158 Malicious code in notify-utilities (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f Package published as notify-utilities masquerades as the pino logger package.json description, keywords, and index.d.ts are copied from pino; the...
TencentOS Server 4: cifs-utils (TSSA-2026:0552)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0552 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2026-55471
CVE-2026-55471 affects HAPI FHIR: org.hl7.fhir.utilities XsltUtilities.saxsonTransform overloads (XsltUtilities.saxonTransform) prior to 6.9.10. The root cause is the use of a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions, enabl...
CVE-2026-15033 christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection
A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...
PT-2026-57873
Name of the Vulnerable Software and Affected Versions Glarysoft Glary Utilities affected versions not specified Description A local privilege escalation flaw exists in the Disk Clean functionality. An attacker with low-privileged code execution capabilities on the target system can create a...
Picklescan vulnerable to Arbitrary File Writing
SummaryPicklescan has got open and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files. DetailsThis is another vulnerability which impacts the downstream user.By...
PYSEC-2026-1986 Transformers's Improper Input Validation vulnerability can be exploited through username injection
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
Transformers's Improper Input Validation vulnerability can be exploited through username injection
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
PYSEC-2026-1576 LLaMA-Factory allows Code Injection through improper vhead_file safeguards
Summary A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vheadfile is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passi...
Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-6923 Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-7349 Malicious code in postgres-docker-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7104 Malicious code in @xp-utilities/web (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7103 Malicious code in @xp-utilities/utilities (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1774 pgAdmin failed to properly control the server code
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an...
PYSEC-2026-803 Cross-site Scripting in django-ajax-utilities
A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...
RHSA-2026:35991 Red Hat Security Advisory: plexus-utils security update
Bulletin has no description...
RHEL 9 : plexus-utils (RHSA-2026:35990)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:35990 advisory. The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a...
Fedora 45 : cifs-utils (2026-90dbff48ca)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-90dbff48ca advisory. Automatic update for cifs-utils-7.6-2.fc45. Changelog Mon Jul 6 2026 Paulo Alcantara - 7.6-2 - cifs.upcall: fix regression with kerberos mounts - Resolves:...
