graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2025-14287 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2025-14287 Source advisory: OSV:PYSEC-2026-2661...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-2033 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-2033 Source advisory: OSV:PYSEC-2026-2658...

nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngxhttpproxyv2module or ngxhttpgrpcmodule with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart ...

Server-side Request Forgery (SSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the htmltomarkdown process. An attacker can access internal network resources by supplyi...

CVE-2026-13014 Remote Code Execution vulnerability in "Suspicious" application

A vulnerability in Thales CERT "Suspicious" application = 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent...

EUVD-2026-43306

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143

The CVE-2026-62143 issue affects the html_to_markdown expansion module of misp-modules. An SSRF protection bypass occurred because IPv4-mapped IPv6 addresses were not normalised before checking blocked IP ranges, allowing an authenticated attacker to supply addresses like http://[::ffff:127.0.0.1...

CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

CVE-2026-57856: Improper Limitation of a Pathname to a Restricted Directory

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

PT-2026-59300

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html to markdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources...

PT-2026-59500

Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...

CVE-2026-62143: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

PT-2026-57660

A Server-Side Request Forgery SSRF protection bypass existed in the html to markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

BIT-JOOMLA-2026-48956 Joomla! Core - [20260710] - Incorrect Access Control in com_modules

An improper access check allows users to display a list of modules in the frontend...

[SECURITY] Fedora 44 Update: p11-kit-0.26.4-1.fc44

p11-kit provides a way to load and enumerate PKCS11 modules, as well as a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...