18370 matches found
Malicious Package
Overview @isfe-common/testing-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview common-icons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview ui-common-components-angular is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview @ng-cat/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @copilot-web-widgets/common-core-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...
CVE-2026-29790: Improper Limitation of a Pathname to a Restricted Directory
dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...
CVE-2026-30793
Cross-Site Request Forgery CSRF vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, FFI bridge modules allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart,...
acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +45 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)
dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =1.8.0, =1.8.2 and more Source cves: CVE-2026-29790 Source advisory: GHSA-W75W-9QV4-J5XJ...
dbt-common's commonprefix() doesn't protect against path traversal
Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...
dbt-fabric (>=1.8.0rc1, <=1.8.0rc2) potentially affected by CVE-2026-29790 via dbt-common (0.1.6)
dbt-common PYPI version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-fabric =1.8.0rc1, =1.8.0rc2 Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...
acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +45 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)
dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =1.8.0, =1.8.2 and more Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...
acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +45 more potentially affected by unknown CVE via dbt-common (>=1.0.0b2, <=1.33.0)
dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =1.8.0, =1.8.2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-DBTCOMMON-15426567...
dbt-databricks (>=1.11.1, <=1.11.3) potentially affected by unknown CVE via dbt-common (1.36.0)
dbt-common PYPI version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-databricks =1.11.1, =1.11.3 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DBTCOMMON-15426567...
dbt-databricks (>=1.11.1, <=1.11.3) potentially affected by CVE-2026-29790 via dbt-common (1.36.0)
dbt-common PYPI version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-databricks =1.11.1, =1.11.3 Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...
dbt-databricks (>=1.11.1, <=1.11.3) potentially affected by CVE-2026-29790 via dbt-common (1.36.0)
dbt-common PYPI version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-common and may be impacted: - dbt-databricks =1.11.1, =1.11.3 Source cves: CVE-2026-29790 Source advisory: GHSA-W75W-9QV4-J5XJ...
GHSA-W75W-9QV4-J5XJ dbt-common's commonprefix() doesn't protect against path traversal
Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...
@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.12-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.6-next.1) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.3-next.1)
@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.6-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...
PT-2026-23610
Name of the Vulnerable Software and Affected Versions dbt-common versions prior to 1.34.2 dbt-common versions prior to 1.37.3 Description A path traversal issue exists in the safe extract function of dbt-common when extracting tarball archives. The function uses os.path.commonprefix to validate...
CVE-2019-25501
creationtimestamp| type| source ---|---|--- 2026-03-04 17:58:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgaucwyvbu2n 2026-03-06 05:40:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mgelybklex2w...