MAL-2026-17461 Malicious code in voxel-tts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5 The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxeltts loads voxeltts/harness.py, which...

ps5-pihost

PS5 Pi Host Use Raspberry Pi OS Lite 64-bit, Bookworm or ne...

[SECURITY] Fedora 45 Update: wv-1.2.9-43.fc45

Wv is a program that understands the Microsoft Word 6/7/8/9 binary file format and is able to convert Word documents into HTML, which can then be read with a browser...

s24-e1q-root

e1q / Galaxy S24 SM-S921W — exploit root + KernelSU + unatte...

[SECURITY] Fedora 45 Update: hivex-1.3.24-22.fc45

Hive files are the undocumented binary files that Windows uses to store the Windows Registry on disk. Hivex is a library that can read and write to these files. 'hivexsh' is a shell you can use to interactively navigate a hive binary file. 'hivexregedit' in perl-hivex lets you export and merge to...

[SECURITY] Fedora 45 Update: glusterfs-11.2-12.fc45

GlusterFS is a distributed file-system capable of scaling to several petabytes. It aggregates various storage bricks over TCP/IP interconnect into one large parallel network filesystem. GlusterFS is one of the most sophisticated file systems in terms of features and extensibility. It borrows a...

[SECURITY] Fedora 45 Update: fontforge-20251009-6.fc45

FontForge former PfaEdit is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts...

Security update for rustup (important)

openSUSE security update: security update for rustup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22016-1 Rating: important References: bsc1230032 bsc1243862 bsc1249008 bsc1257902 bsc1270186 bsc1270521 bsc1270619 bsc1270644 bsc1270795 bsc1270870...

MAL-2026-17457 Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

OPENSUSE-SU-2026:22016-1 Security update for rustup

This update for rustup fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249008. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve...

SUSE-SU-2026:24014-1 Security update for rustup

This update for rustup fixes the following issues: - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249008. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve...

GHSA-96H3-5X6V-M776 Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable vendor/bin command that points at that outside file. This is a path traversal and link...

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable vendor/bin command that points at that outside file. This is a path traversal and link...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +32 more potentially affected by unknown CVE via dulwich (0.22.8)

dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +32 more potentially affected by unknown CVE via dulwich (0.22.8)

dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the socket.io-parser library, which is affected by a denial of service vulnerability. CVE-2026-69185. Vulnerability Details CVEID:CVE-2026-69185 DESCRIPTION: Socket.IO enables bidirectional and low-latency communication fo...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

FTP Service Enumeration & vsftpd 2.3.4 Backdoor Validation...

wp2shell-PoC

wp2shell-PoC ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Overview Proof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137...