RUSTSEC-2026-0412 Arbitrary code execution when rerunning tests from a portable recording

Summary Nextest versions between 0.9.125 and 0.9.149 inclusive allow the cargo nextest run --rerun or -R command with a malicious portable recording to run arbitrary code during the build. The result is arbitrary code execution with the privileges of the user running cargo nextest. This...

Arbitrary code execution when rerunning tests from a portable recording

Summary Nextest versions between 0.9.125 and 0.9.149 inclusive allow the cargo nextest run --rerun or -R command with a malicious portable recording to run arbitrary code during the build. The result is arbitrary code execution with the privileges of the user running cargo nextest. This...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

SUSE CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-58579

RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...

CVE-2026-58579 RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...

CVE-2026-58579 RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...

CVE-2026-58579

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization. The update endpoint normalizes DSL via JSON serialization but preserves the node name, and the dataflow-result UI renders it with dangerouslySetInnerHTML while i18next escapeValue is false, allowing an authentica...

CVE-2026-58579 RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

RAGFlow before 0.26.3 stores an agent pipeline DSL node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalizedsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name int...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-49119 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-49119 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-10783 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-10783 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

When Vitest UI server is listening, arbitrary file can be read and executed

Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...

GHSA-5XRQ-8626-4RWP When Vitest UI server is listening, arbitrary file can be read and executed

Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...

PT-2026-45492

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 4.1.0 Description A flaw in the UI/API server on Windows allows remote attackers to bypass file access restrictions and read arbitrary files when the server is exposed to the network. The issue occurs because the API...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-48545 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-48545 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

@hulumi/baseline: CloudTrail selector tampering events were not fully detected

Impact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing coverage for changes to audit logging configuration. Patched in 1.3.2: detection coverage and regression tests were expanded. Remediation: upgrade @hulumi/baseline to 1.3.2 or lat...