CVE-2026-62392 Apache Kylin: OS Command Injection via Async Query API

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which...

PT-2026-57979

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description An OS Command Injection issue exists where a backend API allows job configuration parameters to be passed directly to the OS command line without proper neutralization of special elements. OS...

PT-2026-57978

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description An SQL Injection issue exists where improper neutralization of special elements used in an SQL command occurs. This happens when a backend API refreshes the table catalog, which may lead to the...

MAL-2026-10454 Malicious code in nodemon-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adb05cacc2c6d1059d9ee1d433398f8e39314ce83aed1429582e5fbb47e8f13a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

PYSEC-2026-2923 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

K000162212: Node.js vulnerabilities CVE-2026-21637 and CVE-2025-59466

Security Advisory Description CVE-2026-21637 A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths...

PT-2026-60003

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate There has always been a limit for the total compressed size. This allows a malicious server to consume effectively unlimited amounts of...

MAL-2026-10164 Malicious code in type-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d064750b4e3821d296d538ea749483e3f9cd54299645fc1c895e5c1af3639b5d The package presents itself as pino typosquat; README mirrors pino. The main entry index.js exports a middleware factory that, on invocation, spawns...

Oracle Linux 9 : kernel (ELSA-2026-33285)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33285 advisory. - tcp: fix potential race in tcpv6synrecvsock Paolo Abeni RHEL-174243 CVE-2026-43198 - crypto: tegra - Add missing CRYPTOALGASYNC Vladislav Dronov...

CVE-2026-53600

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:10+00:00| published-proof-of-concept| https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m...

DEBIAN-CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

CVE-2026-54591 AsyncSSH: SCP Path Traversal to Arbitrary File Write

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

async-tftp (>=0.3.1, <=0.3.6), blindspot (>=1.0.0, <=1.2.2) +8 more potentially affected by CVE-2026-53600 via async-tar (>=0.1.2, <=0.5.1)

async-tar CARGO version =0.1.2, =0.3.1, =1.0.0, =0.7.0, =0.9.0, =0.2.0, =6.1.0, =0.6.0, =0.0.1, =0.0.2 Source cves: CVE-2026-53600 Source advisory: OSV:GHSA-35RM-7J9C-2F7M...

Arbitrary Command Injection

Overview openllm is an OpenLLM: Self-hosting LLMs Made Easy. Affected versions of this package are vulnerable to Arbitrary Command Injection via the asyncruncommand function in the Model Repository Directory Name Handler process. An attacker can execute arbitrary system commands by manipulating t...

kernel: crypto: krb5 - filter out async aead implementations at alloc

A flaw was found in the Linux kernel's Kerberos 5 krb5 cryptography module. This use-after-free vulnerability occurs when an asynchronous Authenticated Encryption with Associated Data AEAD instance is used. The system prematurely frees a memory buffer while a backend process still holds a pointer...

PYSEC-2026-2089

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function asyncruncommand of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement...

CVE-2026-15035

Bentoml OpenLLM 0.6.30 is affected by a command-injection in async_run_command (src/openllm/common.py, Model Repository Directory Name Handler). The vulnerability stems from manipulation of the cmd argument, enabling local exploitation. Public exploit details exist, and attack requires local acce...

CVE-2026-15035 bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function asyncruncommand of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement...

CVE-2026-55688

A flaw was found in the AsyncHttpClient AHC library. The ThreadSafeCookieStore component did not properly verify the domain attribute of cookies, allowing a malicious host to set a cookie for an unrelated domain. This cookie would then be sent by the client in subsequent requests to the targeted...