36511 matches found
CVE-2025-58044
creationtimestamp| type| source ---|---|--- 2026-03-25 05:44:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-58044.yaml 2026-03-26 21:03:04+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mhyiuvbik22q...
Guidance for detecting, investigating, and defending against the Trivy supply chain compromise
In this article 1. Analyzing the Trivy supply chain compromise 2. Detection and investigation 3. Mitigation and protection guidance 4. Advanced hunting queries 5. References 6. Learn more On March 19, 2026, Trivy, Aqua Security’s widely used open-source vulnerability scanner, was reported to have...
CVE-2026-20719: Improper Check for Unusual or Exceptional Conditions
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID:...
GHSA-394X-VWMW-CRM3 vulnerabilities
Vulnerabilities for packages: rustup, wasmcloud, zizmor, linkerd-network-validator, parseable, linkerd-extension-init, ntpd-rs, nushell, lychee, cargo-audit, ztunnel, rustls-ffi, zed, py3-xet-core, linkerd2, deno, qdrant, pixi, buck2, efs-utils, linkerd2-proxy...
CVE-2026-33635
creationtimestamp| type| source ---|---|--- 2026-03-24 19:13:41+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pv9c-9mfh-hvxq...
Malicious code in @pansycareful/github-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fd8e716dd8a1f3d3d8e33d9dfec9cee22ca3b511d7ac05fb3b175da1d1842 The package @pansycareful/github-helper was found to contain malicious code...
MAL-2026-2333 Malicious code in @pansycareful/github-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fd8e716dd8a1f3d3d8e33d9dfec9cee22ca3b511d7ac05fb3b175da1d1842 The package @pansycareful/github-helper was found to contain malicious code...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Amendment This was deemed not a vulnerability. Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via unsanitized interpolatio...
CVE-2026-33475
Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...
CVE-2026-33766
creationtimestamp| type| source ---|---|--- 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf...
CVE-2026-33475
Langflow (before v1.9.0) contains an unauthenticated remote shell injection in multiple GitHub Actions workflows due to unsanitized interpolation of GitHub context variables (e.g., ${{ github.head_ref }}) in run: steps. Attackers can inject and execute arbitrary shell commands via user-controlled...
CVE-2026-33475 Langflow GitHub Actions Shell Injection
Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...
CVE-2026-33475 Langflow GitHub Actions Shell Injection
Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...
EUVD-2026-14790
Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...
CVE-2026-33475 Langflow GitHub Actions Shell Injection
Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...
CVE-2026-33763
creationtimestamp| type| source ---|---|--- 2026-03-24 12:40:05+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8prq-2jr2-cm92...
Malicious code in litellm (PyPI)
litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source the v1.107.0 git tag of BerriAI/litellm does not contain them: they were injected at build or upload time. Every whee...
MAL-2026-2144 Malicious code in litellm (PyPI)
litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source the v1.107.0 git tag of BerriAI/litellm does not contain them: they were injected at build or upload time. Every whee...
TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials
Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as TeamPCP, the cloud-native cybercriminal operation also behind the Trivy supply chain attack. The workflows, both maintained by the supply chain security company...
