CVE-2026-53422

A flaw was found in Erlang OTP's Secure Shell SSH component, specifically within the SSH File Transfer Protocol SFTP daemon's sshsftpd module. An authenticated SFTP user can exploit an observable response discrepancy in the REALPATH handler to enumerate the existence of files and directories...

CVE-2026-54786

A flaw was found in Wasmtime, a runtime for WebAssembly. Its native implementation of WASIp1, a system interface for WebAssembly, contains a resource leak in the fdrenumber function. A malicious guest program can repeatedly call this function, causing the host system to exhaust its file descripto...

Security Bulletin: Vulnerability in Semeru Runtime affecting Rational Business Developer

Summary There are vulnerabilities in Semeru Runtime used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network...

oci-seccomp-bpf-hook security update

1.2.11-2 - rebuild for CVE-2026-33811 Resolves: RHEL-187325...

lib/handlebars/runtime.js Handlebars Template Access Confidential Data Compromise

The vulnerability of the resolvePartial function in the lib/handlebars/runtime.js component, a tool for creating Handlebars templates, is related to the lack of security measures for protecting the structure of web pages. Exploiting this vulnerability could allow an attacker to gain access to...

PYSEC-2026-1075 Malicious code in tiktoken-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tiktoken-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials an...

PYSEC-2026-1074 Malicious code in ray-mcp-server (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of ray-mcp-server were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

PYSEC-2026-1073 Malicious code in orchestr8-platform (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of orchestr8-platform were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...

PYSEC-2026-1071 Malicious code in mem8 (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of mem8 were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and attemp...

PYSEC-2026-1070 Malicious code in langchain-core-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of langchain-core-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...

robotframework-browser (14.3.0), rooster-client (0.0.1) +1 more potentially affected by CVE-2026-0994 via protobuf (4.21.10)

protobuf PYPI version 4.21.10 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - robotframework-browser 14.3.0 - rooster-client 0.0.1 - tracdap-runtime =0.5.4, =0.6.0rc1 Source cves: CVE-2026-0994 Source advisory:...

agent-runtime-server (>=0.0.8, <=0.1.1), ai-application-gateway (>=0.1.1, <=0.1.5) +126 more potentially affected by CVE-2025-62611 via aiomysql (>=0.0.9, <=0.2.0)

aiomysql PYPI version =0.0.9, =0.0.8, =0.1.1, =0.0.1, =1.9.0, =2.10.0, =0.1.0, =0.0.2, =1.0.5, =0.0.154, =0.1.0, =0.1.0, =1.1.1, =3.13.4 and more Source cves: CVE-2025-62611 Source advisory: OSV:PYSEC-2026-1110...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6638 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6638 Source advisory: OSV:PYSEC-2026-1981...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3933 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3933 Source advisory: OSV:PYSEC-2026-1977...

PYSEC-2026-1352 ExecuTorch vulnerable to Heap-based Buffer Overflow attack

A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3777 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3777 Source advisory: OSV:PYSEC-2026-1986...

PYSEC-2026-1997 urllib3 does not control redirects in browsers and Node.js

urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects. However, the retries...

PYSEC-2026-1929 Skyvern has a Jinja runtime leak

Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py...

PYSEC-2026-2023 vLLM Tool Schema allows DoS via Malformed pattern and type Fields

Summary The vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2025-47287 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2025-47287 Source advisory: OSV:PYSEC-2026-1974...