CVE-2026-1300

CVE-2026-1300 refers to the WordPress plugin Responsive Header (versions

OPENSUSE-SU-2026:20103-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 144.0.7559.96 boo1257011 CVE-2026-1220: Race in V8 - update INSTALL.sh to handle the addded tags in the desktop file boo1256938...

Command Injection

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Command Injection via the installfrontmatterrequirements function. An attacker can execute arbitrary code in the context of the service account by supplying crafted input that is not properly validated before...

CVE-2026-0765

CVE-2026-0765 affects Open WebUI via the Python package Open WebUI/PIP install_frontmatter_requirements, where lack of validation of a user-supplied string before a system call enables a remote code execution in the service account context. Attacker authentication is required to exploit. Multiple...

CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability

Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...

Security update for chromium (moderate)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2026:0027-1 Rating: moderate References: 1256938 1257011 Cross-References: CVE-2026-1220 Affected Products: openSUSE Backports SLE-15-SP6 An update that solves one vulnerability and has one errata is now available...

Open WebUI: Operating System Command Injection Vulnerability

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation for the strings provided by users in the...

CVE-2026-24055

Langfuse Slack OAuth installation endpoint (/api/public/slack/install) in versions

CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

langfuse Access Control Vulnerability

Langfuse is an open-source large language model engineering platform developed by Langfuse. Versions of Langfuse 3.146.0 and earlier contained a access control vulnerability. This vulnerability stemmed from the /api/public/slack/install endpoint using ProjectId provided by unauthenticated or...

Malicious code in code-transfering-4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f49b12f95d153280889b4da45b5de3017f21159ad06622092779705ad22e855c Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

MAL-2026-446 Malicious code in code-transfering-4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f49b12f95d153280889b4da45b5de3017f21159ad06622092779705ad22e855c Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

Malicious code in xadauiom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64051fbf2528075ff707f512002bce043db1a535723bd677e6fcde0f53f7cafa Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-440 Malicious code in anduril-lattice-sdk-grpc-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1baa043d99a594c81f1a153d2da1d69bc4a2e67181cdf491c2f06f65120089aa Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-376 Malicious code in coolpackage2323 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfe85cdb01cd65f379803d150e3cd9142774bda4f802120401655f71b5b7a907 During installation and importing the module, the package silently downloads malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2025-33230

NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation of privileges, code execution, data...

Debian: Security Advisory (DLA-4444-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MiracleLinux 8 : flatpak-1.8.7-1.el8 (AXSA:2022-3593:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3593:03 advisory. flatpak: Permissions granted to applications can be hidden from the user at install time CVE-2021-43860 Tenable has extracted the preceding description block...

MiracleLinux 9 : rpm-4.16.1.3-27.el9_3 (AXSA:2024-7473:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7473:01 advisory. rpm: TOCTOU race in checks for unsafe symlinks CVE-2021-35937 rpm: races with chown/chmod/capabilities calls during installation CVE-2021-35938 rpm:...