CVE-2023-54406

Frappe versions prior to 14.59.0 and 15.x before 15.5.0 are vulnerable to a sandbox flaw where the frappe.flags.in_safe_exec global flag can be set to False during Server Script execution. This occurs when one server script triggers another, such as by saving a document. Authenticated high-privil...

CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server...

CVE-2026-46626

Description CVE-2024-50340 GHSA-x8vp-gf4q-mw5j addressed an issue where, with "registerargcargv=On", a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding "--env"/"--no-debug" through "$SERVER'argv'". The fix shipped in "symfony/runtime" 5.4.46 ...

MGASA-2026-0489 Updated tor package fixes security vulnerabilities

This update fixes security issues: - Only accept a CONFLUXLINK cell on a plain OR circuit, and refuse to turn a pending conflux leg into an introduction or rendezvous point. Previously a client could link a rendezvous-point circuit into a conflux set and then, with a forged sequence number in the...

cicd-goat

Entorno CI/CD deliberadamente vulnerable. Hackea pipelines CI/CD, captura las banderas. 🚩 Creado por Cider Security Adquirida por Palo Alto Networks. Tabla de Contenidos Descripción Descargar y ejecutar Linux y Mac Windows Powershell Uso Instrucciones Acepta el desafío Solución de problemas...

CVE-2026-107802

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp, BuildClaudeTranslateCmdLineTemp, and...

CVE-2026-107802

SumatraPDF (version 3.6.1 and earlier) is vulnerable to Windows command-line argument injection within its AI selection-translate feature. The issue resides in src/SelectionTranslate.cpp, where the functions BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTransla...

CVE-2026-107802 SumatraPDF — Windows command-line argument injection in AI selection-translate

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp, BuildClaudeTranslateCmdLineTemp, and...

Nginx-Rift

NGINX Rift Prueba de concepto de RCE para CVE-2026-42945 , un desbordamiento crítico de búfer en el montón en el módulo ngxhttprewritemodule de NGINX introducido en 2008. El error permite la ejecución remota de código no autenticada contra servidores que utilizan las directivas rewrite y set. Est...

Malicious Package

Overview function-flag is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-107802: Improper Neutralization of Argument Delimiters in a Command

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp, BuildClaudeTranslateCmdLineTemp, and...

PT-2026-108295

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.5.3 Description An issue exists where an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting. This command li...

PT-2026-108307

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description In the src/SelectionTranslate.cpp file, selected or pasted translation text is embedded in quoted Windows command lines using incomplete quote-only escaping. This issue affects the...

CVE-2026-107734: Improper Input Validation

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

Rocky Linux 10.2 [CIQ] Security Update: rust-sequoia-sqv-debugsource / sequoia-sqv / sequoia-sqv-debuginfo (crlsa-2026_76735)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676735 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Tenable has extracted the preceding description block...

AlmaLinux 10 : rust-sequoia-sq (ALSA-2026:76737)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:76737 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from...

Rocky Linux 10.2 [CIQ] Security Update: rpm-sequoia / rpm-sequoia-debuginfo / rpm-sequoia-devel / etc (crlsa-2026_76734)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676734 advisory. sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Uninformative error messa...

Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17648 Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RLSA-2026:76737 Important: rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from sequoia-sq rhel-10.2.z JIRA:Rocky Linux-177547 For more details about the security...