Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

OESA-2026-3143 python-filelock security update

Security Fixes: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows loc...

OESA-2026-3129 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number of controls per...

CVE-2026-62825

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-48459

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...

ROS-20260724-73-0023

The vulnerability of the Microsoft .NET software platform is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

PT-2026-64297

Name of the Vulnerable Software and Affected Versions Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec L-VIS versions prior to 8.4.17 Loytec L-PAD...

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte...

The vulnerability of the console-based graphic editor ImageMagick, related to the lack of memory release after the effective lifespan, allows a hacker to trigger a service failure.

The vulnerability of the console-based graphic editor ImageMagick is related to the lack of memory release after the effective lifespan of the software. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-64423

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description An attacker can modify data that should be restricted to read-only access due to incorrect user management. Recommendations At the moment, there is no information about a newer versi...

CVE-2026-43499: A Critical Analysis of the "Zero-Self" Fallacy

This document presents a comprehensive technical analysis refuting the claim that CVE-2026-43499 GhostLock constitutes "no real vulnerability" due to its requirement for local access and user interaction. Through rigorous examination of the attack surface, exploitation vectors, and real-world...

CVE-2026-50044 Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack...

CVE-2026-34496

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

EUVD-2026-48427

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Impact The JDBC spec defines the interface DataSource, with a method called getConnection, and ConnectionPoolDataSource, with a method called getPooledConnection. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated,...

CVE-2026-16756 Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed,...

CVE-2026-65699 AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...