62428 matches found
GO-2026-5897 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder...
CVE-2026-11348
creationtimestamp| type| source ---|---|--- 2026-07-07 15:22:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2vue5nff2v...
SUSE CVE-2026-54060
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile assembled per-glyph images into a combined bitmap with Image.new"1", xsize, ysize without calling Image.decompressionbombcheck, allowing a font to trigger excessive allocation during conversion or saving. This...
CVE-2026-53877
creationtimestamp| type| source ---|---|--- 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:13:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yqc7v5w2x 2026-08-13 13:08:52+00:00| seen|...
PYSEC-2026-1393 Frappe has Possibility of Remote Code Execution due to improper validation
Impact A system user was able to create certain documents in a specific way that could lead to RCE. Workarounds There's no workaround, an upgrade is required. Credits Thanks to Thanh of Calif.io for reporting the issue...
Frappe has Possibility of Remote Code Execution due to improper validation
ImpactA system user was able to create certain documents in a specific way that could lead to RCE. WorkaroundsThere's no workaround, an upgrade is required. CreditsThanks to Thanh of Calif.io for reporting the issue...
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
PYSEC-2026-1555 LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Improper Authorization vulnerability in Apache Superset whenFABADDSECURITYAPI is enabled disabled by default. Allows for lower privilege users to use this API.issue affects Apache Superset: from 2.0.0 before 4.1.0.Users are recommended to upgrade to version 4.1.0, which fixes the issue...
PYSEC-2026-1447 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
Impact Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. Patches The problem has been fix...
Pulp incorrectly assigns RBAC permissions in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...
PYSEC-2026-1808 Pulp incorrectly assigns RBAC permissions in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability...
PYSEC-2026-1117 Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability...
Directory creation by malicious user in saltstack
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can leada malicious attacker to create an arbitrary directory on a Salt master...
CVE-2026-53483
creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...
mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...
PYSEC-2026-1655 mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...
PYSEC-2026-1249 Out of memory error when submitting the dataset form with a specially-crafted field
Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...