MAL-2026-17926 Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing

A flaw was found in GIMP, specifically within the parsing of High Dynamic Range HDR files. This integer overflow vulnerability occurs due to insufficient validation of user-supplied data before memory allocation. A remote attacker could exploit this by convincing a user to open a specially crafte...

Important: Red Hat Security Advisory: gegl04 security update

An update for gegl04 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 CTF Challenge 배포 정보 | 항목 | 값 | |------|---...

PT-2026-117535

A segmentation violation in the dump isom saps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

ROS-20261019-73-0037

The vulnerability of the go-git library is related to a countable amount of significance loss. Exploiting this vulnerability can allow an attacker to cause a service failure by using a specially created malicious .idx file...

CVE-2026-111936: Server-Side Request Forgery (SSRF)

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

ROS-20261019-73-0001

The vulnerability of the ffhevcputhevcepelpixels8sse function in the h.265 Libde265 implementation is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created video file...

ROS-20261019-73-0003

The vulnerability of the putepelhvfallback function in the h.265 Libde265 implementation is related to the issue where the operation’s output goes beyond the buffer boundaries during processing of the unsigned short data type. Exploiting this vulnerability could allow a remote attacker to cause a...

ROS-20261019-73-0004

The vulnerability of the ffhevcputhevcqpelh3v3sse function in the h.265 Libde265 implementation is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through the use of a specially...

CVE-2026-89286: Exposure of Sensitive Information to an Unauthorized Actor

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2025-52290

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows an attacker to cause a Denial of Service (DoS) . The vulnerability is triggered by processing a crafted media file , which leads to an unexpected application crash. No speci...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2026-11319: Improper Limitation of a Pathname to a Restricted Directory

TickTick Android application com.ticktick.task 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename vi...

HPE Compute Scale-up Server 3200 platform input validation error vulnerability

A input validation error vulnerability exists in HPE Compute Scale-up Server 3200 versions prior to 1.77.30, HPE Compute Scale-up Server 3250 versions prior to 1.03.38, and HPE Superdome Flex server versions prior to 4.17.03. This vulnerability can be exploited remotely to list and modify the RMC...

Amasty Order Attributes 3.16.0 Arbitrary File Upload

Amasty Order Attributes versions through version 3.16.0 contain an unauthenticated arbitrary file upload vulnerability. This proof of concept uploads supplied HTML content or, in full mode, PHP web shells. https://packetstorm.news/download/236358...

PT-2026-117402

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit h...

CVE-2025-55667: Improper Restriction of Operations within the Bounds of a Memory Buffer

A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-117351

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...