CVE-2026-108811

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

CVE-2026-108811 WMCMS index.php information disclosure

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

CVE-2026-108811 WMCMS index.php information disclosure

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

EUVD-2026-97284

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

PT-2026-110495

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

CVE-2026-85668

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668: External Control of File Name or Path

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-11049 Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Linux Distros Unpatched Vulnerability : CVE-2026-64033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of...

EUVD-2026-45606

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created and srvpath-kobj may already have been initialized. If a later step...

CVE-2026-64033 RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created and srvpath-kobj may already have been initialized. If a later step...

CVE-2026-64033

CVE-2026-64033 describes a use-after-free in Linux kernel RDMA/rtrs path file cleanup. In rtrs_srv_create_path_files(), if an error occurs after sysfs root folders were created and srv_path->kobj initialized, cleanup calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root...

PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

SummaryPDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins.Th...

MAL-2026-10091 Malicious code in qlinforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713a696ce725031aab16903d7a29c80611a4c4368c7e35bacf29069a3581c602 setup.py registers a custom install command that, on Linux, downloads an opaque binary from http://115.190.124.243:9090/payloadlinuxamd64 to...

CVE-2026-46121

A flaw was found in the Linux kernel's DAMON Data Access MONitor sysfs interface. A race condition exists between read and write operations on the memcgpath and path files. This allows a local attacker, by performing concurrent reads and writes with separate file handles, to trigger a...

Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fc219f03cbaeeedb660ad423cc7af08ff1d29154c8b8989b7b0c5d7d5c3d75 setup.py installs a.pth file containing import gttesterexpprofilerexp00000015.probe; probe.runprobe, causing every Python interpreter start on the...

CVE-2026-40191 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization FAA rules and App Jail...

MAL-2026-2122 Malicious code in rowrapee (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 398cfbdac2d3602a5c9836408942993c3f2bbcda911184825f01cf9937fb035e The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it...

MAL-2026-1496 Malicious code in robloxapi-testy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0221b6839d8882a9275e177ae71c7bed9cc15a96800e4cead5766c67f0dd042 Installation embeds a malicious PTH file that then during import downloads and executes remote code. During analysis, the remote code was a test starting...