CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-17346

CVE-2026-17346 affects pgAdmin 4 (Index Statistics sink for all-indexes listing in 1.0 and Publications/Subscriptions sinks in 5.0 prior to 9.17). The issue arose after CVE-2026-12044 fix: templates for sixteen COMMENT ON / pgstattuple / pgstatindex were hardened with qtLiteral, but several sinks...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

MAL-2026-11417 Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

MAL-2026-11414 Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

SUSE CVE-2023-34620

An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

PT-2026-66771

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.16 pgAdmin 4 versions 5.0 through 9.16 Description An issue exists where schema, table, publication, and subscription names sourced from pg catalog via the browser tree are not properly escaped. Because...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses yaml-1.10.2.tgz, idna-3.10-py3-none-any.whl, pyjwt-2.12.1-py3-none-any.whl, postcss-8.5.3.tgz, postcss-selector-parser-6.0.10.tgz which are vulnerable to CVE-2026-33532, CVE-2026-45409, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525,...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses yaml-2.6.1.tgz, log4j-api-2.24.3.jar, onnx-1.21.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, spring-boot-autoconfigure-3.5.14.jar, spring-web-6.2.18.jar, dompurify-3.3.3.tgz, netty-codec-http-4.2.12.Final.jar, qs-6.14.2.tgz,...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses transformers-4.57.6-py3-none-any.whl, transformers-5.3.0-py3-none-any.whl, netty-codec-http-4.2.12.Final.jar, netty-codec-dns-4.2.12.Final.jar, netty-resolver-dns-4.2.12.Final.jar which are vulnerable to CVE-2026-5241, CVE-2026-42580,...

EEF-CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Summary Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which...

PT-2026-65798

Name of the Vulnerable Software and Affected Versions Gleam versions 0.18.0 through 1.17.x Description Insufficient verification of data authenticity allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. While Gleam fetches package metadata from...

This Week in Spring - July 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! The title says in Spring , but here in the northern hemisphere, it's clearly the middle of summer. Hot! I'm sitting here on my laptop on a warm summer day, and my laptop is indeed hot because I've spent so much time outside...

GHSA-GCJH-H69Q-9W9G cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

The function ext.NativeTypesParseStructTag"json" does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dynobj"-". Additionally, newNativeTypes...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by unknown CVE via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-MONGOOSE-18319533...