CodeQL 2.26.0

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...

ImageMagick SVG DoS

The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

lib/parse.js Component DoS

The vulnerability of the lib/parse.js component, a library for analyzing and transforming string queries in Node QS, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

Joern 4.0.578

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-56483

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.2.0 Description The Series Chart operation allows prototype pollution when parsing user-supplied CSV data because it accepts proto as a key. Prototype pollution is a technique where an attacker manipulates the...

angr 9.2.223

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

ida_kernelcache: An IDA Toolkit for analyzing iOS kernelcaches

idakernelcache is an IDAPython module for IDA Pro to make working with iOS kernelcaches easier. idakernelcache has been tested with IDA Pro 6.95 on kernelcaches for iOS versions 10.1.1, 11.0, 11.2, 11.3.1, and 12.0 beta. Currently only Arm64 kernelcaches from iOS 10 and later are supported...

cve-poc-collection

CVE PoC Vulnerability Reproduction Collection This repository...

PYSEC-2026-1668 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Summary A Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...

MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

SummaryA Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The android:host attribute from elements is rendered in HTML reports without...

PYSEC-2026-1370 Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling's assessment Fickling started emitting AST nodes for builtins imports in order to match them during analysis https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf. Original report Summary Fickling works by Pickle bytecode -- AST -- Security analysis...

Fickling has a bypass via runpy.run_path() and runpy.run_module()

Fickling's assessmentrunpy was added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66. Original report SummaryFickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious...

Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling's assessmentFickling started emitting AST nodes for builtins imports in order to match them during analysis https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf. Original report SummaryFickling works byPickle bytecode -- AST -- Security analysisHowever...

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling's assessmentctypes, importlib, runpy, code and multiprocessing were added the list of unsafe imports https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66, https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9,...

anomalydetection (0.0.0.dev1), cdci-data-analysis (>=1.3.1, <=1.3.2) potentially affected by CVE-2026-21883 via bokeh (0.12.16)

bokeh PYPI version 0.12.16 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - anomalydetection 0.0.0.dev1 - cdci-data-analysis =1.3.1, =1.3.2 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1223...

fantasy-analysis (>=0.0.0, <=0.0.3), hc-nlp (>=0.1.0, <=0.2.0) +1 more potentially affected by CVE-2025-53000 via nbconvert (6.4.4)

nbconvert PYPI version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - fantasy-analysis =0.0.0, =0.1.0, =2.4.0, =8.2.0 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-53000 via nbconvert (6.0.4)

nbconvert PYPI version 6.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-59842 via jupyterlab (2.2.8)

jupyterlab PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2025-59842 Source advisory: OSV:PYSEC-2026-1482...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-6051 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-6051 Source advisory: OSV:PYSEC-2026-1988...

aspect-based-sentiment-analysis (2.0.2), docly (>=0.0.4, <=0.2.1) +2 more potentially affected by CVE-2025-6051 via transformers (2.5.0)

transformers PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aspect-based-sentiment-analysis 2.0.2 - docly =0.0.4, =0.0.7b0, =0.1.9, =0.1.18 Source cves: CVE-2025-6051 Source advisory:...