CVE-2026-68514

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep...

CVE-2026-68515

OpenEXR is the reference implementation for the EXR image format used in the motion picture industry. A heap out-of-bounds write exists in the exrmultiview utility when combining two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's chann...

Malicious code in minecraft-ytreceiver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...

MAL-2026-14516 Malicious code in minecraft-ytreceiver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...

CVE-2026-80050

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-61555

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-65979

OpenEXR (the reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain an out-of-bounds read in the HTJ2K decoder . The decoder parses a header-length field (PLEN ) from a chunk's compressed data and advances the codestrea...

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

Impact An arbitrary file write vulnerability CWE-73, External Control of File Name or Path exists in the consciousness-explorer component of sublinear-time-solver. The MCP exportstate and importstate tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync /...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm sublinear-time-solver versions 1.6.0...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm consciousness-explorer versions 1.1.2...

EUVD-2026-65706

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. The vulnerability is a path traversal in the MCP server tools: export_state and import_state (in src/consciousness-explorer/mcp/server.js) and saveVectorToFile / loadVecto...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

EUVD-2026-45030

Whistle vulnerable to path traversal...

CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-80050

ContiNew Admin versions through 4.1.0 contain a missing authorization and file-type allowlist vulnerability in its multipart upload endpoints (specifically MultipartUploadController). Authenticated users can initialize chunked uploads, send file parts, and complete uploads with arbitrary file ext...

EUVD-2026-65702

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-61555 OpenEXR: Empty multiView viewFromChannelName file crash

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...