CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-53970

ZeroBrew 0.3.1 and earlier is affected by a missing integrity verification vulnerability in the Ruby compatibility shim (shim.rb). An attacker could substitute malicious content at formula resources or URL-based patch URLs without checksum validation, allowing remote code execution when downloads...

CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

EUVD-2026-58684

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-73480

A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface TUI. An attacker can craft malicious directory or file names...

CVE-2026-73555

A flaw was found in vLLM, an inference and serving engine for large language models. Unauthenticated attackers can send malformed JSON requests to various API endpoints, triggering validation errors. The system's error handling mechanism converts these validation errors into strings without...

CVE-2026-73490

A flaw was found in Loofah. The HTML5 sanitizer incorrectly applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A remote attacker could exploit this by crafting a sanitized SVG that referenc...

CVE-2026-73557

A flaw was found in vLLM, an inference and serving engine for large language models. An incomplete remediation for a previous vulnerability CVE-2025-62164 can be bypassed. This occurs when concurrent prompt parts are processed, leading to a race condition in the handling of sparse tensors. This...

CVE-2026-73558

A flaw was found in vLLM, an inference and serving engine for large language models. An integer overflow vulnerability in the actandmulkernel kernel allows a remote attacker to cause cross-user data leakage. By crafting specific requests processed in the same inference batch, an attacker can obta...

CVE-2026-73621

A flaw was found in GitPython. An argument injection vulnerability in the Commit.count method allows an attacker to control options passed to the method. By supplying a crafted output option, an attacker can cause the git rev-list command to truncate an arbitrary file to zero bytes. This enables...

CVE-2026-73651

A flaw was found in TypeORM. TypeORM's migration:generate command, used for generating database migrations, embeds database schema metadata into JavaScript or TypeScript template literals. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. An...

CVE-2026-73648

A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

CVE-2026-73559

A flaw was found in vLLM, an inference and serving engine for large language models. An authenticated API client can exploit this vulnerability by sending a single request to the /v1/completions endpoint with an excessively large list of prompts. This unbounded input causes the vLLM server to...

CVE-2026-45774

A flaw was found in compliance-trestle. The library's profile import mechanism, which handles trestle:// URIs and relative file paths, does not properly validate paths. This allows a remote attacker to craft a malicious OSCAL Open Security Controls Assessment Language profile YAML file containing...

CVE-2026-73566

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lea...

CVE-2026-73622

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

CVE-2026-45725

A flaw was found in compliance-trestle. The library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher does not properly sanitize path traversal sequences ../ when constructing local cache file paths from URLs. A remote attacker can exploit this by referencing a malicious URL in an...

CVE-2026-73556

A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated remote attacker can exploit a Regular Expression Denial of Service ReDoS vulnerability in the lm-format-enforcer backend. By submitting a specially crafted regular expression through the...