160235 matches found
CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...
EUVD-2026-95908
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...
CVE-2026-9198
🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...
ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +31 more potentially affected by CVE-2026-107292 via pydantic-ai (>=1.34.0, <=1.107.4)
pydantic-ai PYPI version =1.34.0, =0.1.14.13, =0.0.2, =1.34.0, =1.0.0, =1.0.0, =0.1.102, =26.0.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107292 Source advisory: GHSA-Q2XC-RRXJ-58X9...
ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +31 more potentially affected by CVE-2026-107295 via pydantic-ai (>=1.34.0, <=1.107.2)
pydantic-ai PYPI version =1.34.0, =0.1.14.13, =0.0.2, =1.34.0, =1.0.0, =1.0.0, =0.1.102, =26.0.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107295 Source advisory: OSV:GHSA-H4XC-3QFQ-JF93...
agent-runtimes (0.0.9), agent-utilities (>=0.41.0, <=0.51.0) +87 more potentially affected by CVE-2026-107293 via pydantic-ai-slim (>=0.3.4, <=1.107.2)
pydantic-ai-slim PYPI version =0.3.4, =0.41.0, =0.1.14.13, =0.0.2, =0.3.4, =0.0.174, =1.0.0, =0.1.0, =0.9.0, =1.2.0 - eea-genai-blocks 1.0.0 - eea-genai-core 1.2.0 - eea-genai-summary 1.0.0 and more Source cves: CVE-2026-107293 Source advisory: GHSA-3GH4-CGHQ-F8V4...
ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +54 more potentially affected by CVE-2026-107293 via pydantic-ai (>=0.3.4, <=1.107.2)
pydantic-ai PYPI version =0.3.4, =0.1.14.13, =0.0.2, =0.3.4, =0.0.174, =1.0.0, =0.9.0, =20250930132735.0.0.dev0, =0.1.102, =2.2.0, =0.6.3, =26.0.0, =26.1.1 and more Source cves: CVE-2026-107293 Source advisory: GHSA-3GH4-CGHQ-F8V4...
agent-runtimes (0.0.9), agent-utilities (>=0.41.0, <=0.51.0) +88 more potentially affected by CVE-2026-107291 via pydantic-ai-slim (>=0.3.4, <=1.107.5)
pydantic-ai-slim PYPI version =0.3.4, =0.41.0, =0.1.14.13, =0.0.2, =0.3.4, =0.0.174, =1.0.0, =0.1.0, =0.9.0, =1.2.0 - eea-genai-blocks 1.0.0 - eea-genai-core 1.2.0 - eea-genai-summary 1.0.0 and more Source cves: CVE-2026-107291 Source advisory: GHSA-4X9P-G9WM-8Q7F...
The Amplifier Effect: Human-Factor Risks of AI-Suggested Correlation and Auto-Propagation in Multi-Framework GRC Self-Assessment
Multi-framework Governance, Risk and Compliance GRC platforms increasingly automate the link between an organisation's self-assessment answer and the compliance obligations that answer is said to satisfy. Cross-framework control mapping, AI-suggested question correlation, and automatic propagatio...
auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-96749 via pymongo (3.10.0)
pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...
auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-88029 via pymongo (3.10.0)
pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...
CVE-2026-12171
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
EUVD-2026-92475
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
CVE-2026-12171
Versions of auto-changelog prior to 2.6.1 are vulnerable to code execution , argument injection , path traversal , and SSRF because they process untrusted configuration from within the target repository (e.g., .auto-changelog or package.json). Specifically, the handlebarsSetup option is passed to...
Astra Linux – Vulnerability in Linux
A race condition in Linux kernel SCTP sockets net/sctp/socket.c before version 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If the sctpdestroysock function is called without using the socknetsk-sctp.addrwqlock lock, an element...
Astra Linux – Vulnerability in Firefox and Thunderbird
If a user installed an extension of a particular type, the extension might automatically update itself. During this process, it could bypass the prompt that grants the new version the newly requested permissions. This vulnerability affects Firefox 97, Thunderbird 91.6, and Firefox ESR 91.6...
PT-2026-106024
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...