CVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to childprocess.exec for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename...

CVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to childprocess.exec for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename...

CVE-2026-52891

Wekan prior to v9.07 is vulnerable to command execution via avatar upload. The avatar filename is embedded in shell commands in models/avatars.js and models/fileValidation.js, allowing shell metacharacters (e.g., ` and $( ) to run commands on the server through child_process.exec(). Impact: high ...

CVE-2026-52891 Wekan: Shell Injection via Avatar Upload

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to childprocess.exec for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename...

Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

MAL-2026-10689 Malicious code in pylogora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...

MAL-2026-10688 Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

PT-2026-60317

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.07 Description The avatar upload functionality allows the embedding of user-supplied filenames into paths that are subsequently passed to the child process.exec function for MIME-type detection. Specifically, the...

MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

MAL-2026-10576 Malicious code in tennacity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7933cd1ec11531feba788870555eeac615535d8e230b4d252880def9c68ff5e tennacity is a one-character typosquat of the popular 'tenacity' library; its README/PKG-INFO are copied verbatim from real tenacity while setup.py...

Malicious code in tennacity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7933cd1ec11531feba788870555eeac615535d8e230b4d252880def9c68ff5e tennacity is a one-character typosquat of the popular 'tenacity' library; its README/PKG-INFO are copied verbatim from real tenacity while setup.py...

CVE-2026-7640

creationtimestamp| type| source ---|---|--- 2026-07-14 06:02:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqljtphk2b2t 2026-07-19 20:28:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmlkp2rf2o 2026-07-19 20:28:50+00:00| seen|...

podman security update

5.8.2-5.0.1 - Rework CNI/Netavark detection logic JIRA: EVG-3769 - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.8.2-5 - rebuild for CVE-2026-39822 - Resolves: RHEL-193646...

PYSEC-2026-2471 Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

Summary Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletio...

Malicious code in sso-users-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993 [email protected] is a hollow package main exports , empty author/description, inflated 99.9.1 version whose sole effect on install is to pu...

MAL-2026-10422 Malicious code in sso-users-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993 [email protected] is a hollow package main exports , empty author/description, inflated 99.9.1 version whose sole effect on install is to pu...

CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is abl...

PT-2026-63656

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depo...

Exploit for Improper Authentication in Apache Tomcat

CVE-2026-29145 – Everything Apache Tomcat CLIENTCERT + OCS...

CVE-2026-57219

creationtimestamp| type| source ---|---|--- 2026-07-11 02:34:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdmti4ic42f 2026-07-14 05:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqligiqa3y2s 2026-07-15 11:28:22+00:00| seen|...