1716 matches found
Malicious code in @onereach/si-a-button (npm)
npm/@onereach/si-a-button is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...
Malicious code in @onereach/phonenumber-interpreter (npm)
npm/@onereach/phonenumber-interpreter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
PYSEC-2026-3571 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
SummaryThe standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit ADK Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posti...
The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin allows a attacker to execute arbitrary code.
The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a attacker to execute arbitrary code...
The vulnerability of the JSON Script Runner component of the cross-platform application for viewing and modifying database data in the DbGate browser allows a perpetrator to execute arbitrary code.
The vulnerability of the JSON Script Runner component in a cross-platform application for browsing and modifying database data in the DbGate browser is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
ROS-20260803-73-0007
The vulnerability of the act Runner component in the Git repository management system Gitea is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
📄 DbGate 7.1.8 Remote Code Execution
A proof of concept exploit for a DbGate 7.1.8 unauthenticated remote code execution vulnerability. The exploit abuses the /runners/start endpoint by injecting JavaScript through the JSON script runner's functionName field, allowing arbitrary operating system commands to be executed and their outp...
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...
GHSA-JX74-CQJV-2C67 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...
CLEANSTART-2026-KJ23421 Security fixes in gitlab-runner 18.11.1-r0
Package gitlab-runner version 18.11.1-r0 fixes 21 vulnerabilities: ghsa-6g7g-w4f8-9c9x, ghsa-pjcq-xvwq-hhpj, ghsa-p77j-4mvh-x3m3, ghsa-pc3f-x583-g7j2, ghsa-78h2-9frx-2jm8...
CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...
CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...
CVE-2026-67426
Flyto2 Core contains an unauthenticated SSRF risk in the standalone flyto-verification service (src/core/verification_service.py) prior to version 2.26.7. The service exposed POST /run on 0.0.0.0:8344 and used a client-supplied callback_url for outbound POSTs with X-Internal-Key: $FLYTO_RUNNER_SE...
CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...
GHSA-H5PW-H3J7-CJ7F vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-PGGX-2V9R-J6GM vulnerabilities
Vulnerabilities for packages: gitlab-runner...