9419 matches found
Security update for python-nltk (important)
openSUSE Security Update: Security update for python-nltk Announcement ID: openSUSE-SU-2026:0269-1 Rating: important References: 1272667 Cross-References: CVE-2025-71408 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...
The vulnerability of the Python library for working with Git Dulwich repositories lies in the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary commands.
The vulnerability of the Python library for working with Git repositories in Dulwich is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)
Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
cmdchamp v1.2.15
cmdchamp Bash CLI trainer — 30 levels from ls to privilege escalation. Every question asks you to type a real command — get instant feedback, move on. Many run against real files in the sandbox, and all accept multiple valid syntaxes sort -u or sort | uniq. Tab toggles the manpage when you need a...
JLSEC-2026-1083 ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line...
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...
JLSEC-2026-1051
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of...
CVE-2026-41186
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
CVE-2026-41186
The CVE-2026-41186 issue affects Calico components (shared debug server used by kube-controllers and Goldmane). When enabled, the Go pprof debug listener binds to 0.0.0.0 and lacks authentication, allowing any pod with network reachability to access internal memory state via the heap, goroutine s...
EUVD-2026-51155
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server
When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...
CLEANSTART-2026-JW02028 Security fixes in az 2.84.0-r2
Package az version 2.84.0-r2 fixes 4 vulnerabilities: CVE-2026-44432, CVE-2026-44431, CVE-2026-39892, CVE-2026-45409...
PT-2026-76123
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...
MAL-2026-11180 Malicious code in aone-cloud-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac6b6dc6a9ebc0c474150ee0d6545f6c3fa790ada20f247ac997ec504ce6ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-16107
IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...
SUSE CVE-2025-71408
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
CVE-2026-66011
A flaw was found in ImageMagick. This memory leak vulnerability occurs when invalid options are provided to the magick command-line interface CLI. An attacker can exploit this by repeatedly supplying malformed command-line arguments, leading to memory exhaustion and a denial of service DoS on the...
[SECURITY] Fedora 43 Update: rpm-6.0.2-1.fc43
The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Each software package consists of an archive of files along with information about the package like its version, a...
PT-2026-69162
It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04...
Malicious Package
Overview @tarojs/cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
