ANT-2026-9WB9SMM6 · libass · heap-buffer-overflow

heap-buffer-overflow high GHSA-pjjp-65r7-ppgm Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-9WB9SMM6: Heap-buffer-overflow in...

ANT-2026-GSPVGEYA · gpg/libgcrypt · Stack Buffer Overflow

stack-buffer-overflow medium CVE-2026-41990 GHSA-78pv-qq8x-94px Severity Claude high · Security research firm - · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-GSPVGEYA: ML-DSA...

ANT-2026-VN61PHA0 · gitea · IDOR

idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...

ANT-2026-X3EB6DN3 · expat · heap-buffer-overflow

heap-buffer-overflow medium CVE-2026-56132 GHSA-425r-vwq2-26qv Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-X3EB6DN3...

ANT-2026-FW0V6SAJ · dhis2-core · SQL Injection

sql-injection high CVE-2026-55084 Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-FW0V6SAJ: SQL Injection via Unquoted Column Name in SqlView Filter Parameter...

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

GHSA-3496-9G83-7V6X sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

SUSE CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

SUSE CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

EUVD-2026-60256

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

CVE-2026-75057

In IntelliJ IDEA before 2026.1.5, Git credentials were written in plaintext to the IDE log, exposing them to any local user with log read access. CVSS 6.2 (MEDIUM) reflects high confidentiality impact. Exploitation details are not provided; upgrade to 2026.1.5 to remediate.

CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

Neo9Root iQOO Neo9 PD2338C Unlocked Without Unlocking –...

Exploit for CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.sel...

GHSA-2QVG-QR73-MQXP conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...