Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

MAL-2026-17179 Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

Langflow AI - Unauthenticated Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. id: CVE-2025-3248 info: name: Langflow AI - Unauthenticated Remote Code Execution author: nvn172...

OESA-2026-4080 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...

OESA-2026-4066 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote,...

OESA-2026-4064 python-black security update

The uncompromising code formatter Security Fixes: Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was...

OESA-2026-4052 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in...

OESA-2026-4009 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

EUVD-2026-86479

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

Malicious code in vercel-runtime-python (PyPI)

Source: kam193 5bd13c006fe4fbaf8bb81d068f6e3c822ea1e664b24d0045370aead862ccd06f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

A Three-Party W-State Quantum Secret Sharing Protocol with X-Gate Encoding and Forbidden-Outcome Detection

We develop a new three-party quantum secret-sharing QSS protocol based on a three-qubit W state. This protocol encodes the secret-sequence bits using X gates and employs randomly selected Hadamard operations and measurement bases to generate information and security-test rounds. We evaluate the...

Asynchronous Python-daphne Unlimited Resource Distribution DoS

The vulnerability of the asynchronous Python-daphne web server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

GitPython Command Injection

The vulnerability in the Python library for interacting with Git repositories GitPython is related to parameter injection or modification. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-96747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in .sock as a local Unix domain...

Linux Distros Unpatched Vulnerability : CVE-2026-57175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer...

Linux Distros Unpatched Vulnerability : CVE-2026-59980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input...

openSUSE 16 Security Update : python-weasyprint (openSUSE-SU-2026:21928-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21928-1 advisory. Changes in python-weasyprint: - CVE-2026-55073: Server-Side Request Forgery SSRF bsc1279942 Tenable has extracted the preceding description block direct...

python-cryptography security update

43.0.0-4 - Fix CVE-2026-69249: add X.509 signature validation budget...

Linux Distros Unpatched Vulnerability : CVE-2026-57177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the...

Linux Distros Unpatched Vulnerability : CVE-2026-57176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the...