132097 matches found
Semaphore U: OS Command Injection
Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...
GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection
Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo
CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...
GHSA-74PJ-6G7R-J55C SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo
CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
Scope note please read first This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 "Improve database field visibility across views", 11020 and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable...
GHSA-57V5-WQX3-CGJ4 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
Scope note please read first This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 "Improve database field visibility across views", 11020 and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable...
Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.324 Vulnerability Details CVEID:CVE-2025-11468 DESCRIPTION: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis...
Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub
Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.4.0 Patch 6 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in recent security patch releases. Vulnerability Details CVEID:CVE-2026-55654 DESCRIPTION: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI Generic Securit...
Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance
Summary Vulnerabilities identified in cyclops of IBM Netezza Appliance have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2026-59843 DESCRIPTION: A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing...
NLTK: Corpus Reader Sandbox Bypass
Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...
GHSA-3GQ4-3J92-5W49 NLTK: Corpus Reader Sandbox Bypass
Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...
GHSA-P4RW-RVV2-7XWR NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...
K000163233: BIND vulnerability CVE-2026-10822
Security Advisory Description If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and...
Security Bulletin: Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
Summary Langflow uses a code security scanner and component-level execution policies to restrict server-side code execution to authorized users and contexts. The agentic assistant code scanner employs an incomplete denylist omitting process-spawning primitives and contains a logic error where...
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...
GHSA-RHP5-R9X4-F5G2 NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...