2198 matches found
MemoryOS 2.0.34 was published with a credential-stealing binary
An attacker with write access to the GitHub repository pushed maliciouscommits and tagged v2.0.34, and the project's own GitHub Actions releaseworkflow built and uploaded 2.0.34 to PyPI.Importing the package runs memos/stage0.py, which launchesa bundled sckit binary that collects...
PYSEC-2026-3987 MemoryOS 2.0.34 was published with a credential-stealing binary
An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/stage0.py, which launches a bundled sckit binary that collects credentials...
Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows | Cloud Foundry
Severity CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ---|--- Vendor CloudFoundry Foundation Versions Affected The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected. Description GitHub Actions workflows were configured to trigger on pullrequesttarg...
CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
EUVD-2026-83981
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
CVE-2026-54916
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...
CVE-2026-54752
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
EUVD-2026-82414
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...
CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...
CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...
CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
EUVD-2026-82413
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
CVE-2026-54752
NetBox Device Type Library is a community-sourced collection of device type definitions for import into NetBox. The vulnerability resides in the read_pickle_data function within tests/pickle_operations.py, which uses pickle.load to deserialize pull-request-controlled tracked pickle cache files. A...
CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
CVE-2026-54916: Uncontrolled Search Path Element
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...
CVE-2026-54752: Deserialization of Untrusted Data
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...
PT-2026-95096
Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...
PT-2026-95095
Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...
