CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC Scalable Video Coding layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer contex...

CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...

EUVD-2026-54080

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

MAL-2026-13413 Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

Security update for openssl-1_1

This update for openssl-11 fixes the following issue HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

dist/routes/oauth2/index.js SSRF Information Disclosure

The vulnerability of the dist/routes/oauth2/index.js file of the software platform for creating user interfaces through Language Model LLMs like Flowise relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker to perform an SSRF attack...

Tenable Sensor Proxy < 1.4.2 Code Injection (TNS-2026-21)

According to its self-reported version, the Tenable Sensor Proxy running on the remote host is prior to 1.4.2. It is, therefore, affected by code injection vulnerability as referenced in the TNS-2026-21 advisory. - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code...

EulerOS 2.0 SP13 : python3 (EulerOS-SA-2026-3045)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the preceding...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic component resolution. An attacke...

CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

DEBIAN-CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

EUVD-2026-53643

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-55522

CVE-2026-55522 – PraisonAI workflow include bypasses tools.py autoload . Affected: PraisonAI versions 3.9.26–4.6.57 and PraisonAIAgents 0.12.12–1.6.57. The workflow include feature (Workflow._execute_include) imports and executes a recipe’s tools.py via importlib.util.spec_from_file_location() an...

Malicious code in croft-node (npm)

Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to https://my-api.trade-api.workers.dev?id=1 and executes globalThisdata.success...