4447 matches found
PT-2026-93833
Name of the Vulnerable Software and Affected Versions Airbyte OneDrive Connector affected versions not specified Description An issue exists in the get shared drive object function that allows remote authenticated attackers to initiate arbitrary server-side requests. This occurs due to insufficie...
Astra Linux – Vulnerability in freerdp2
FreeRDP is a free remote desktop protocol library and client. Versions of FreeRDP affected by this issue lack input length validation in the “drive” channel. A malicious server can trick a FreeRDP-based client into reading out-of-bound data and sending it back to the server. This issue has been...
CVE-2026-90534: Authorization Bypass Through User-Controlled Key
Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...
MAL-2026-15978 Malicious code in drive-album (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b552aab413e10d8cc2363896d1735041227c764470db3de7cde26705996b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in drive-album (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b552aab413e10d8cc2363896d1735041227c764470db3de7cde26705996b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview drive-album is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
CVE-2026-81717
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
PYSEC-2026-3801
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
PYSEC-2026-3801
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81717
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in its portable USB drive feature, whose threat model assumes an attacker with physical write access to the drive. First, USBDriveCreator._verify_integrity_file validates only files listed in the manifest, so an at...
EUVD-2026-67067
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
PT-2026-82612
openssl encrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator. verify integrity file only validates files listed in the manifest, s...
CVE-2026-81717: Improper Verification of Cryptographic Signature
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in node-tar has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...
invertedai-drive (0.1.0) potentially affected by CVE-2026-73415 via jupyterlab (3.4.4)
jupyterlab PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - invertedai-drive 0.1.0 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...
BIT-LIBPYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...