ROOT-APP-PYPI-CVE-2026-54530 CVE-2026-54530 in pypdf - Patched by Root

Root has patched CVE-2026-54530 in the pypdf package for Root:PyPI. Multiple fixed versions available...

CVE-2026-67623

Technical details about CVE-2026-67623 are not publicly available in the provided documents. No vendor, product versions, affected components, or remediation are specified here. Monitor for updates in future connected documents.

EUVD-2026-53342

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

Malicious code in remote_session_elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69 Package version 9999.0.0 is published with placeholder metadata "Shared utility helpers.", no author — the canonical shape of a dependency-confusion...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

Froxlor < 0.10.38.2. - HTML Injection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. id: CVE-2022-3869 info: name: Froxlor TEST" matchers-condition: and matchers: - type: word part: body words: - 'The message to ""TEST" failed' - type: word part: header words: - "text/html" - type: status status: - 200 d...

phpMyFAQ < 3.2.0 - Cross-site Scripting

Cross-site Scripting XSS Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. id: CVE-2023-5863 info: name: phpMyFAQ ' - 'phpMyFAQ' condition: and - type: word part: header words: - "tex...

Structurizr on-premises - Cross Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository structurizr/onpremises prior to 3194. id: CVE-2023-5556 info: name: Structurizr on-premises - Cross Site Scripting author: shankaracharya severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository...

FOSSBilling < 0.5.3 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. id: CVE-2023-3521 info: name: FOSSBilling &datefrom='" HTTP/1.1 Host: Hostname matchers-condition: and matchers: - type: word part: body words:...

Hestiacp <= 1.7.7 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. id: CVE-2023-3479 info: name: Hestiacp = 1.7.7 - Cross-Site Scripting author: edoardottt severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository hestiacp/hestiacp prior to...

ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

Mosparo < 1.0.2 - Open Redirect

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. id: CVE-2023-5375 info: name: Mosparo 1.0.2 - Open Redirect author: shankaracharya severity: medium description: | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. impact: | Unauthenticated attackers can exploit...

Imgproxy < 3.14.0 - Cross-site Scripting (XSS)

Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...

CVE-2026-47781

A flaw was found in PDM, a Python package and dependency manager. This vulnerability allows an attacker to execute arbitrary Python code by placing a malicious file in a project's .pdm-plugins directory within an untrusted repository. When a user invokes PDM, even with a benign command, the...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

CVE-2026-47781 affects PDM up to v2.26.9, where Core.init() calls load_plugins() and adds the project-local .pdm-plugins via site.addsitedir(). This causes .pth files to be processed, allowing attacker-controlled content in an untrusted repository checkout to execute arbitrary Python code before ...

EUVD-2026-52799

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

CVE-2026-47487

The CVE-2026-47487 vulnerability affects NVIDIA Triton Inference Server for Linux, specifically when using the Triton MLflow plugin where a model-name path can cause files outside the model repository to be read, written, or modified. The root cause is path handling in the MLflow plugin that fail...

katello: missing repository authorization in content_uploads exposes cross-product content existence

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the editproducts permission to query content information for repositories outside the products they were authorized to...