161072 matches found
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Reporter: Cavan Loughran, Celvex Group Inc.Summary-------The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still re-pars...
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...
PYSEC-2026-4078 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
PYSEC-2026-4164 sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-102826
A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve...
CVE-2026-102505
A flaw was found in perl-Imager. When processing floating-point samples from a paletted image, the application allocates an undersized buffer for multi-channel requests. An attacker could provide a specially crafted image to trigger a heap-based buffer overflow with controlled data, potentially...
CVE-2026-92867
A flaw was found in Pgpool-II. An out-of-bounds write vulnerability allows an authenticated remote attacker to corrupt memory. This issue may enable the attacker to achieve arbitrary code execution or trigger an abnormal process crash, resulting in a denial of service DoS. Mitigation Disable the...
CVE-2026-12540 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
CVE-2026-12540
A command injection vulnerability exists in the Foreman software within the foreman-rake errors:fetch_log task. The flaw is caused by the request_id parameter being passed to an underlying system command (typically grep ) without sufficient shell neutralization. An attacker with sudo permissions ...
EUVD-2026-90916
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
CVE-2026-12540
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
EUVD-2026-90902
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...
CVE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...
CVE-2026-63292
A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...
GHSA-JXXV-8R27-VM4P vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...
Critical: Red Hat Security Advisory: Satellite 6.19.5 Async Update
A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...