14506 matches found
PYSEC-2026-1781 Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
Summary Using idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.debugobj.ObjectTreeItem.SetText function in...
PYSEC-2026-1792 Picklescan is missing detection when calling built-in python ensurepip._run_pip
Summary Using ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to ensurepip.runpip function in reduce method Then when the victim after...
PYSEC-2026-1786 Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
Summary Using idlelib.calltip.Calltip.fetchtip, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.calltip.Calltip.fetchtip function in reduce method The...
PYSEC-2026-1985 Transformers vulnerable to ReDoS attack through its get_imports() function
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...
PYSEC-2026-1069 Malicious code in instructor-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of instructor-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
PYSEC-2026-1068 Malicious code in dreamgen (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of dreamgen were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...
@edgebrix-sdk/react (>=0.0.58, <=0.0.74), @kimia_software/tellair-wc (0.0.0) +16 more potentially affected by CVE-2026-56812 via phoenix (>=1.6.2, <=1.6.16)
phoenix NPM version =1.6.2, =0.0.58, =0.8.10, =0.1.8, =0.1.5, =0.1.0-rc0, =0.8.1, =0.0.1, =0.0.1, =0.0.0-PR-1--182e1d3, =19.0.0-beta.1, =1.0.23, =0.3.0, =0.1.1, =0.1.6 and more Source cves: CVE-2026-56812 Source advisory: OSV:EEF-CVE-2026-56812...
Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
MAL-2026-6919 Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
Malicious code in chai-chain-test (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7242 Malicious code in chai-chain-test (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in angulafjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in amgularjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ajgularjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zwknum2 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in zwag26 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9314 Malicious code in wbotbzr999 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9026 Malicious code in tryf0zz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in prxca79e95716 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MiracleLinux 9 : git-lfs-3.7.1-4.el9_8 (AXSA:2026-1205:08)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1205:08 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the...