196290 matches found
Important Photon OS Security Update - PHSA-2026-4.0-1056
Updates of 'podman' packages of Photon OS have been released...
Updated ffmpeg packages fix a security vulnerability
The updated packages fix a security vulnerability: Heap out-of-bounds write via odd sliceheight in FFmpeg MagicYUV decoder. CVE-2026-8461...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...
GHSA-C9X3-CMJ9-8PXM vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-387M-935M-C4VW vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
Malicious Package
Overview @gleamkit/engine.io is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PYSEC-2026-2395 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore is an open-source SDK that enables developers to build, deploy, and manage agents on AWS Bedrock AgentCore. An issue exists in the installpackages method of the Code Interpreter client where crafted package name arguments can bypass...
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
SummaryThe AWS Bedrock AgentCore Python SDK bedrock-agentcore is an open-source SDK that enables developers to build, deploy, and manage agents on AWS Bedrock AgentCore. An issue exists in the installpackages method of the Code Interpreter client where crafted package name arguments can bypass...
agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-54531 via pypdf (3.17.0)
pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-54531 Source advisory: OSV:PYSEC-2026-3022...
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
PYSEC-2026-2918 PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent proces...
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
SummarySeveral WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model.Confirmed mismatches:- ADD user can reorder packages/files...
dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-15031 via mlflow (1.27.0)
mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...
PYSEC-2026-3002 libsodium has Incomplete List of Disallowed Inputs
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. This advisoory...
abba-python (>=0.1.6, <=0.3.0), adversal-embedding (>=0.0.1, <=0.0.7) +52 more potentially affected by CVE-2022-35971 via tensorflow (1.15.0)
tensorflow PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - abba-python =0.1.6, =0.0.1, =0.2.6, =2023.1.0, =0.2.11, =0.0.4, =0.10.0, =0.10.1 - deepaclive 0.1.0 and more Source cves: CVE-2022-35971...
RHSA-2026:38694 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...