GHSA-PWGV-4X5Q-6M9F vulnerabilities

Vulnerabilities for packages: mlflow, airflow...

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

MAL-2026-14158 Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

CVE-2026-55224

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:30+00:00| published-proof-of-concept| https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj 2026-08-19 09:00:04+00:00| confirmed|...

CVE-2026-70666

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:18+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww 2026-08-19 09:32:00+00:00| seen| https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8...

CVE-2026-73974

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-52877

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

CVE-2026-52875

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52872

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-50186

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

CVE-2026-50186

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

EUVD-2026-62202

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

EUVD-2026-62199

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52876

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...

EUVD-2026-62198

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...