Malicious code in rxwws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rjan2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8504 Malicious code in retryqq3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pwnlambcal3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pwnlambcal1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oakmi17100 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oailmc (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8256 Malicious code in oaijhghatpit (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaihx0157786 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in m8405v0nhw (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lbrssuuxosyfo (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lbqtcccksw (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lammeet00 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1644 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

PYSEC-2026-1292 dbt allows Binding to an Unrestricted IP Address via socketsocket

Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...

Potential DoS via the Tudoor mechanism in eventlet and dnspython

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in whic...

PYSEC-2026-1780 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

PYSEC-2026-1174 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0...

Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

ImpactThe Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being...

Defining resource name as integer may give unintended access in vantage6

ImpactMalicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names.One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for...