3874 matches found
Command Injection
Overview check-peer-dependencies is a Checks peer dependencies of the current package. Offers solutions for any that are unmet. Affected versions of this package are vulnerable to Command Injection in the shelljs.exec function of the peerDependencies component in packageUtils.js. An attacker can...
CVE-2026-15033 christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection
A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...
PT-2026-56413
A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...
PT-2026-57873
Name of the Vulnerable Software and Affected Versions Glarysoft Glary Utilities affected versions not specified Description A local privilege escalation flaw exists in the Disk Clean functionality. An attacker with low-privileged code execution capabilities on the target system can create a...
(0Day) Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Disk...
CVE-2026-14895
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex...
Picklescan vulnerable to Arbitrary File Writing
SummaryPicklescan has got open and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files. DetailsThis is another vulnerability which impacts the downstream user.By...
keras-utilities (>=0.1.7, <=0.1.27) potentially affected by CVE-2025-12060 via keras (1.2.1)
keras PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-utilities =0.1.7, =0.1.27 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...
keras-utilities (>=0.1.7, <=0.1.27) potentially affected by CVE-2025-12058 via keras (1.2.1)
keras PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-utilities =0.1.7, =0.1.27 Source cves: CVE-2025-12058 Source advisory: OSV:PYSEC-2026-1487...
LlamaIndex vulnerable to Path Traversal attack through its encode_image function
A path traversal vulnerability exists in run-llama/llamaindex versions 0.11.23 through 0.12.40, specifically within the encodeimage function in genericutils.py. This vulnerability allows an attacker to manipulate the imagepath input to read arbitrary files on the server, including sensitive syste...
Transformers vulnerable to ReDoS attack through its get_imports() function
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...
PYSEC-2026-1986 Transformers's Improper Input Validation vulnerability can be exploited through username injection
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
Transformers's Improper Input Validation vulnerability can be exploited through username injection
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...
PYSEC-2026-1576 LLaMA-Factory allows Code Injection through improper vhead_file safeguards
Summary A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vheadfile is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passi...
Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-6923 Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-7349 Malicious code in postgres-docker-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @xp-utilities/web (npm)
--- -= Per source details. Do not edit below this line.=-...