25 matches found
GHSA-3HRF-2GC2-MX32 Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Summary Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an OpenAPI description is written into...
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Summary Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an OpenAPI description is written into...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the C doc-comment generation in CSharpConventionService and OpenApiUrlTreeNodeExtensions. An attacker can inject executable C into generated clients by supplying description, externalDocs label, or link...
doc-comments-ai (>=0.1.0, <=0.1.10), modelmerge (>=0.1.5, <=0.2.2) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.271)
langchain PYPI version 0.0.271 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - doc-comments-ai =0.1.0, =0.1.5, =0.2.2, =0.7.1, =0.7.3 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...
doc-comments-ai (>=0.1.11, <=0.1.12), myllm (>=2.0.5, <=2.0.6) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.284)
langchain PYPI version 0.0.284 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - doc-comments-ai =0.1.11, =2.0.5, =0.0.1, =0.0.4, =0.0.15 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...
autogpt-forge (>=0.1.0, <=0.1.3), cosmoai (>=0.6.0, <=0.6.6) +12 more potentially affected by CVE-2026-12773 via litellm (0.1.7713)
litellm PYPI version 0.1.7713 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - autogpt-forge =0.1.0, =0.6.0, =0.2.4, =0.1.11, =0.0.1, =0.1.7, =0.1.0, =0.1.2, =0.0.2, =0.0.3 - yival 0.1.0a4 Source cves: CVE-2026-12773 Sourc...
autogpt-forge (>=0.1.0, <=0.1.3), cosmoai (>=0.6.0, <=0.6.6) +12 more potentially affected by CVE-2026-12772 via litellm (0.1.7713)
litellm PYPI version 0.1.7713 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - autogpt-forge =0.1.0, =0.6.0, =0.2.4, =0.1.11, =0.0.1, =0.1.7, =0.1.0, =0.1.2, =0.0.2, =0.0.3 - yival 0.1.0a4 Source cves: CVE-2026-12772 Sourc...
ai-agents (>=0.0.2, <=0.0.5), doc-comments-ai (0.1.13) +5 more potentially affected by CVE-2026-55443 via langchain (0.0.308)
langchain PYPI version 0.0.308 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - ai-agents =0.0.2, =1.3.0, =1.3.0, =0.0.7, =0.0.8 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
codeqai (>=0.0.6, <=0.0.10), commitgpt (1.0.0) +3 more potentially affected by CVE-2026-55443 via langchain (0.0.329)
langchain PYPI version 0.0.329 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - codeqai =0.0.6, =0.1.1, =0.1.14, =0.1.18 - vizro-ai 0.1.1 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
doc-comments-ai (>=0.1.0, <=0.1.10), modelmerge (>=0.1.5, <=0.2.2) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.271)
langchain PYPI version 0.0.271 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - doc-comments-ai =0.1.0, =0.1.5, =0.2.2, =0.7.1, =0.7.3 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
doc-comments-ai (>=0.1.11, <=0.1.12), myllm (>=2.0.5, <=2.0.6) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.284)
langchain PYPI version 0.0.284 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - doc-comments-ai =0.1.11, =2.0.5, =0.0.1, =0.0.4, =0.0.15 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...
autogpt-forge (>=0.1.0, <=0.1.3), cosmoai (>=0.6.0, <=0.6.6) +12 more potentially affected by CVE-2026-47101 via litellm (0.1.7713)
litellm PYPI version 0.1.7713 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - autogpt-forge =0.1.0, =0.6.0, =0.2.4, =0.1.11, =0.0.1, =0.1.7, =0.1.0, =0.1.2, =0.0.2, =0.0.3 - yival 0.1.0a4 Source cves: CVE-2026-47101 Sourc...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.6
Red Hat OpenShift Service Mesh 3.1.6 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.1....
cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...
Important: Red Hat Security Advisory: go-toolset:rhel8 security update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...
cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...
cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...
MGASA-2026-0035 Updated golang packages fix security vulnerabilities
net/http: memory exhaustion in Request.ParseForm. CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives. CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level. CVE-2025-61730 cmd/go: bypass of flag sanitization can lead to...
Updated golang packages fix security vulnerabilities
net/http: memory exhaustion in Request.ParseForm. CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives. CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level. CVE-2025-61730 cmd/go: bypass of flag sanitization can lead to...