@whalent/agent (0.3.266) potentially affected by unknown CVE via @whalent/agent-core (0.3.266)

@whalent/agent-core NPM version 0.3.266 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.266 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

MAL-2026-10749 Malicious code in sync-grove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65248cd6e2924b6485824bcf382441e39d5e09860bc1e849aee0d6d289d184fb Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exe...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

EUVD-2026-44889

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

PT-2026-60435

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr token function in all versions up to, and including, 7.3.1.4. This makes it possible for...

Exploit for CVE-2026-48909

CVE-2026-48909-Joomla-SP-Exploit CVE-2026-48909 - Unauthentica...

CVE-2026-46421 Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421 Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

a2rl (>=1.0.0, <=1.2.0), aana (>=0.2.1, <=0.2.2.2) +2034 more potentially affected by CVE-2026-58659 via pytorch-lightning (>=0.5.3.2, <=2.6.5)

pytorch-lightning PYPI version =0.5.3.2, =1.0.0, =0.2.1, =1.1.0, =0.0.0, =1.0.1, =2.1.1, =2.0.0, =1.3.0, =0.1.0, =0.1.0, =1.0.1, =0.1.0, =0.4.1, =0.4.7 and more Source cves: CVE-2026-58659 Source advisory: SNYK:PYTHON-PYTORCHLIGHTNING-18016331...

MAL-2026-10687 Malicious code in selparsecss-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f [email protected] is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' while the LICENSE-MIT, sour...

@n8n/agents (0.13.0), @n8n/ai-node-sdk (0.18.0) +17 more potentially affected by CVE-2026-59259 via n8n-workflow (2.28.0)

n8n-workflow NPM version 2.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-workflow and may be impacted: - @n8n/agents 0.13.0 - @n8n/ai-node-sdk 0.18.0 - @n8n/ai-utilities 0.21.0 - @n8n/ai-workflow-builder 1.28.0 - @n8n/api-types 1.28.0 -...

CVE-2026-61446

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

CVE-2026-61446

CVE-2026-61446 affects PraisonAI before 1.6.78. The plugin manager loads and executes arbitrary Python files from plugin directories using importlib and exec_module without code signing or sandboxing, enabling a local attacker who can write a malicious .py file to achieve arbitrary code execution...

CVE-2026-61446 PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

An update for golang-github-openstack-k8s-operators-os-diff is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...