PT-2026-71449

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the check unsafe options guard present in the sibling iter items method. An attacker who can control options passed to Commit.count e.g., via...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

PT-2026-71388

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get advance file by url method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

PT-2026-71655

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

Alibaba Cloud Linux 3 : 0256: mingw-glib2 (ALINUX3-SA-2026:0256)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0256 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-14087: A flaw was found in GLib...

PT-2026-71452

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

EUVD-2026-58030

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

PT-2026-71716

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle incoming method in libp2p/stream muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read exactly before validating it against MAX WINDOW SIZE or checking...

PT-2026-71833

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6 Description An issue exists in the platform for building and deploying managed AI agents and workflows. The endpoint "/api/v1/deployments/:deploymentId/background-workers" invokes the...

CVE-2026-67986

Summary: CVE-2026-67986 affects the Ruby gem amazing_print. A flaw in AwesomeMethodArray#grep allows Ruby code execution in the host process when a block is used and a specially named method containing interpolation syntax is interpolated into a dynamically constructed eval string. Exploitation r...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

Does Fixing Break Security? an Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-As-Code Repair

Background: Iterative feedback loops are the dominant paradigm for improving LLM-generated Infrastructure-as-Code IaC: validators such as Checkov and terraform validate feed error signals back for successive repair attempts. Prior work reports cumulative-best metrics, which are non-decreasing by...

hyperlight-overlaybd-poc

hyperlight-overlaybd-poc Can the output of a sandboxed job...

Cross-site Scripting (XSS)

Overview @jupyterlab/imageviewer is a JupyterLab - Image Widget Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ImageViewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted SVG image in the image viewer...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-64826

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport method. Attackers can craft requests with ../ sequences to escape th...

[SECURITY] [DLA 4736-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 12, 2026 https://wiki.debian.org/LTS -...

EUVD-2026-57622

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...