PYSEC-2026-1127 ansys-geometry-core OS Command Injection vulnerability

subprocess call with shell=True identified, security issue. Code On file src/ansys/geometry/core/connection/productinstance.py: 403 def startprogramargs: Liststr, localenv: Dictstr, str - subprocess.Popen: 404 """ 405 Start the program where the path is the first item of the args array argument...

CVE-2026-42883

Summary of CVE-2026-42883 (Audiobookshelf) Affected product: Audiobookshelf (self-hosted audiobook/podcast server) prior to version 2.32.2. Vulnerability: The GET /api/libraries/:id/download endpoint validates that the requester has access to the library in the URL path, but it fetches downloadab...

Information Disclosure

gitlab is vulnerable to Information Disclosure. Under certain conditions, improper access control in the library allows a malicious actor to gain information of the most recent commit in a private project via Merge Requests...