126040 matches found
RHEL 8 : freerdp (RHSA-2026:38501)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38501 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...
PT-2026-59026
Summary Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a...
RockyLinux 8 : nginx:1.24 (RLSA-2026:38847)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:38847 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements:...
ALSA-2026:38498 Important: openexr security update
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...
Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...
PT-2026-57865
Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the...
PT-2026-59500
Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...
PT-2026-59160
Summary glances/outdated.py uses pickle.load to read a version-check cache file stored at a predictable, world-accessible path /.cache/glances/glances-version.db or $XDG CACHE HOME/glances/glances-version.db. No integrity check, signature verification, or format validation is performed before...
The vulnerability of the vm2 package manager’s code transformer allows a hacker to execute arbitrary code.
The vulnerability of the vm2 package manager’s code transformation transformer is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
RHEL 9 : perl-DBI (RHSA-2026:38512)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:38512 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions,...
nginx security, bug fix, and enhancement update
1.20.1-28.0.1.el98.4 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.4 - Resolves: RHEL-190800 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves:...
ROS-20260713-73-0004
The vulnerability of the net/textproto component in the Go programming language is related to incorrect processing of output data for registration logs. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-59115
Background This vulnerability is found in the diffusers package - the transformers-equivalent library for diffusion models. It is found in the DiffusionPipeline.from pretrained flow, which is used to load a pipeline from the HuggingFace Hub. This function has a trust remote code guard: if the...
Important: gegl04 security update
GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing CVE-2026-2050 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and oth...
Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...
MAL-2026-10210 Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
MAL-2026-10213 Malicious code in pipspeed (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1037d713fe94f92e9f1302a1c8fdfcd03ee290e1f2076e7c01cbd1305499e91 The package's advertised public entry point pipspeed.optimize GETs a JSON document from https://www.jsonkeeper.com/b/53XMN an anonymous, mutable past...
Malicious code in polymarket-kelly-math-stake (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...
Arbitrary Code Injection
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Arbitrary Code Injection via the CodeAgent.executepython function. An attacker can execute arbitrary code and exfiltrate environment secrets...