CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

CVE-2026-81429 Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

CVE-2026-81429 Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin (versions through 1.0.2 ) is vulnerable to a CSRF to Stored Cross-Site Scripting flaw. The issue arises because the template-import feature fails to perform CSRF checks and does not sanitise imported data before storing and echoing it. An...

EUVD-2026-76785

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

Chromium CVE-2026-76018: Privilege elevation in Import

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-90568

Name of the Vulnerable Software and Affected Versions Export & Import WPBakery Page Builder versions prior to 1.0.3 Description The template-import feature lacks Cross-Site Request Forgery CSRF checks and fails to sanitize imported data before storage and output. This allows an attacker to trick ...

CVE-2026-81429: Improper Neutralization of Input During Web Page Generation

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-54166

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166

Shelf , a physical asset tracking platform, contains a Server-Side Request Forgery (SSRF) in its Asset CSV Content Import feature prior to version 1.20.3 . Authenticated users with the asset:import permission can bypass imageUrl validation using image-extension suffixes, path keywords, domain sub...

EUVD-2026-76766

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

OPENSUSE-SU-2026:21833-1 Security update for jq

This update for jq fixes the following issues: - CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure bsc1265071. - CVE-2026-47770: stack overflow in deep structural equality bsc1269221...

MAL-2026-16127 Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...