ROOT-APP-PYPI-CVE-2026-34518 CVE-2026-34518 in aiohttp - Patched by Root

Root has patched CVE-2026-34518 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in aiohttp - Patched by Root

Root has patched CVE-2026-34993 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54280 CVE-2026-54280 in aiohttp - Patched by Root

Root has patched CVE-2026-54280 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

CVE-2026-18720

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

OfficeWeb365 Indexs Interface - Arbitrary File Read

There is any file reading in the officeWeb365 Indexs interface. id: CVE-2024-37728 info: name: OfficeWeb365 Indexs Interface - Arbitrary File Read author: DhiyaneshDK severity: high description: | There is any file reading in the officeWeb365 Indexs interface. impact: | Unauthenticated attackers...

Vite dev server - Cross-Site Scripting

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

CVE-2026-18720

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

CVE-2026-18720

The CVE concerns kalcaddle kodbox 1.67 Build 02, specifically the /index.php?plugin/msgWarning/action area of the msgWarning Plugin. The vulnerability allows remote, unauthenticated manipulation leading to improper authorization. Exploitation is reported as possible, with PoC exploit activity obs...

ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root

Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28490 CVE-2026-28490 in Authlib - Patched by Root

Root has patched CVE-2026-28490 in the Authlib package for Root:PyPI. Multiple fixed versions available...

CVE-2026-67975

CVE-2026-67975 concerns NASA cFS v7.0.1, where an incorrect access control vulnerability in the NASA cFS stack allows an attacker to arbitrarily remove low-index subscriptions and add new streams by sending TO_LAB add/remove subscription commands. The affected component is the cFS core system; th...

MAL-2026-11429 Malicious code in trongriden (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

Summary re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those...