36090 matches found
PT-2026-50492
Name of the Vulnerable Software and Affected Versions Pi versions prior to 0.79.0 Description Pi loads project-local configuration and resources from a repository's .pi directory without requiring user trust. This includes project-local extensions, which are executable TypeScript or JavaScript...
CVE-2026-10850: Improper Neutralization of Input During Web Page Generation
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure. Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty...
GHSA-94F4-HR76-P5J6 vLLM: OpenAI auth bypass
Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured VLLMAPIKEY or...
Malicious code in strict-engine-peer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0913b30a168bfed09d3c5ae59aeaf6a305a395f86516fb1fb8ece60bb95904de On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads the installer's project...
MAL-2026-5898 Malicious code in strict-engine-peer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0913b30a168bfed09d3c5ae59aeaf6a305a395f86516fb1fb8ece60bb95904de On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads the installer's project...
GHSA-6HW7-J4JW-WPFF Galaxy NG: command injection vulnerability
A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...
Malicious code in create-vercel-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62 Package name mimics Vercel's official create- initializer convention e.g. create-next-app, targeting developers who mistype or guess the initializer...
MAL-2026-5894 Malicious code in create-vercel-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62 Package name mimics Vercel's official create- initializer convention e.g. create-next-app, targeting developers who mistype or guess the initializer...
Malicious code in @dsft/ft-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...
MAL-2026-5890 Malicious code in @dsft/ft-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...
MAL-2026-5889 Malicious code in @dsft/ft-element (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...
MAL-2026-5899 Malicious code in stripe-cli-init-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bd1dbc9732ef80aca27acad964c041b74e646e26cf4947ad34807c41d2c4a8 Package name 'stripe-cli-init-plugin' impersonates the Stripe CLI ecosystem and ships a bin script bin/run.js that, when invoked via npx...
USN-8433-1 keystone vulnerabilities
It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. CVE-2026-33551 It was discovered...
CVE-2026-8484
A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...
CVE-2026-8484
The CVE-2026-8484 entry describes a heap buffer overflow in the Jansi JNI"ioctl()" wrapper caused by missing size verification of the argument array before the system call. Affected software is Jansi (JNI wrapper) and, per sources, all versions are believed vulnerable. Consequences stated are hea...
CVE-2026-8484
A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...
PT-2026-50059
Name of the Vulnerable Software and Affected Versions Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. A high privileged attacker with...
PT-2026-50061
Name of the Vulnerable Software and Affected Versions Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. A low privileged attacker with...
PT-2026-50060
Name of the Vulnerable Software and Affected Versions Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. A low privileged attacker with...