CVE-2026-48995

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to serve malicious software packages if the codeload.github.com server is compromised or a user's machine configuration is tampered with. The issue arises because pnpm does not verify the integrity of...

Core dump when loading TFLite models with quantization in TensorFlow

ImpactCertain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling.Thus, since code was calling...

PYSEC-2026-952 Incomplete validation in signal ops leads to crashes in TensorFlow

Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274. The fix will be...

CVE-2026-59710: Improper Neutralization of Input During Web Page Generation

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

GITHUB Kubernetes Rancher Unauthorized Access

The vulnerability of the GitHub authentication provider for Kubernetes Rancher software management systems is related to flaws in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

GHSA-J687-52P2-XCFF

creationtimestamp| type| source ---|---|--- 2026-07-05 13:35:36+00:00| seen| https://gist.github.com/konard/88609dd395d6031e4d410d3826dc1450...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the LFS object reuse process. An attacker can gain unauthorized access to private source objects by leveraging repository access without having the required Code-unit permissions...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the CODEOWNERS pattern matching process. An attacker can cause excessive resource consumption by submitting specially crafted patterns, potentially leading to service unavailability. Remediation Upgrade...

kev-tracker

🎯 KEV Tracker Daily automated tracking of the CISA Known Ex...

PT-2026-55584

Name of the Vulnerable Software and Affected Versions identrail affected versions not specified Description An Insecure Direct Object Reference IDOR exists where the connection-completion endpoint binds a client-supplied installation id to the caller's workspace without verifying that the...

CVE-2026-57168

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:13+00:00| published-proof-of-concept| https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf...

CVE-2026-52817

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg...

CVE-2026-52834

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:09+00:00| published-proof-of-concept| https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-5pmv-rx8r-wmv5...

CVE-2026-49852

creationtimestamp| type| source ---|---|--- 2026-07-02 20:35:04+00:00| published-proof-of-concept| https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh 2026-07-17 22:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqur7v4av42e...

GHSA-9H3P-52VH-959W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-50181

creationtimestamp| type| source ---|---|--- 2026-07-02 18:35:09+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-fg23-3346-88f5 2026-07-13 22:00:06+00:00| seen| https://t.me/GithubRedTeam/92599 2026-07-14 00:00:10+00:00| seen|...

GHSA-3P4H-7M6X-2HCM

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:57+00:00| seen| https://gist.github.com/konard/2d84a73c0ff6413bca5b0e79fa90d50e 2026-07-03 13:46:19+00:00| seen| https://gist.github.com/konard/21e8411dcc1ecc12ae0a937b657f93ae 2026-07-03 14:16:44+00:00| seen|...