30505 matches found
GO-2026-5876 Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher
Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5844 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5843 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5811 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli
turso-cli persists Turso platform JWT with world-readable 0o644 file permissions in github.com/tursodatabase/turso-cli...
GO-2026-5842 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
PYSEC-2026-1284 Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are...
PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability
A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...
Malicious code in @bmg-web/bmg-snackbar (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1763 PDM Trojan Lockfile
Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...
PDM Trojan Lockfile
SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it
Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...
PYSEC-2026-1456 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it
Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...
PYSEC-2026-1694 Denial of service in neutron
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and...
Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
...
Linux Distros Unpatched Vulnerability : CVE-2026-41434
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology...
Important: libheif
Issue Overview: A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 and likely earlier versions within the handling of uncompressed HEIF images ISO/IEC 23001-17, unci item type. When processing a tiled image with chroma subsampling e.g., 4:2:0 or 4:2:2, the library fails...
PT-2026-56305
Name of the Vulnerable Software and Affected Versions goploy version 1.17.5 Description An Insecure Direct Object Reference IDOR exists in the project and project-file handlers. The application fails to verify if a project or project-file belongs to the caller's namespace when processing requests...
