23570 matches found
OSEC-2026-04 Bigarray.reshape integer overflow
The function camlbareshape, part of the OCaml runtime in runtime/bigarray.c, had a missing check for integer overflow when computing the size to be allocated. This leads to a segmentation fault. Any application using Bigarray.reshape or reshapeN with untrusted and unchecked input can result in a...
Untrusted Search Path
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Untrusted Search Path via the CLOUDSDKPYTHON environment variable in the .env file during the Gmail setup process. An attacker can cause unintended Python runtime execution by manipulatin...
Embedding Forbidden Text in Spyware to Discourage AI Analysis
At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis. Details: The index.js payload begins with a large JavaScript block comment containing fake system instructions and policy-triggering content. Because it...
Malicious Package
Overview runtime-metrics-w7k2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-53145
Summary The execute code tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins . In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining tw...
Siemens RUGGEDCOM RST2428P Incorrect Bitwise Shift of Integer (CVE-2025-40281)
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of- bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
Important Photon OS Security Update - PHSA-2026-5.0-91-0884
Updates of 'dotnet-runtime', 'frr', 'freetype2' packages of Photon OS have been released...
PT-2026-53187
Summary The Docker API server accepted a request-supplied browser config.extra args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command --utility-cmd-prefix, --renderer-cmd-prefix, --gpu-launcher,...
DISARM: Target Electronic Device Informed Mitigation of Software Runtime Side-Channel Vulnerabilities
Program runtime or timing attacks exploit variations in a program's execution times to extract sensitive information from the program e.g. encryption keys, sensitive variable data, intellectual property. State-of-the-art solutions to runtime side-channel attacks attempt to balance the execution...
Important Photon OS Security Update - PHSA-2026-5.0-0884
Updates of 'freetype2', 'dotnet-runtime', 'frr' packages of Photon OS have been released...
PT-2026-51056
Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.3.2 containerd versions prior to 2.2.5 containerd versions prior to 2.1.9 containerd versions prior to 2.0.10 containerd versions prior to 1.7.33 Description A bug in the CRI plugin allows the propagation of labe...
PT-2026-51048
Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.3.2 containerd versions prior to 2.2.5 containerd versions prior to 2.1.9 containerd versions prior to 2.0.10 containerd versions prior to 1.7.33 Description A maliciously crafted image can cause a Denial of...
assistant-stream (0.0.1), mirapi (>=0.0.1.dev0, <=0.0.3) +4 more potentially affected by CVE-2026-48817 via starlette (0.39.2)
starlette PYPI version 0.39.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - assistant-stream 0.0.1 - mirapi =0.0.1.dev0, =0.0.3 - nlip 0.1.0 - pyonir 0.0.4 - scout-runtime 0.1.0 - starlette-authlib 0.3.2 Source cves:...
assistant-stream (0.0.1), mirapi (>=0.0.1.dev0, <=0.0.3) +4 more potentially affected by CVE-2026-48818 via starlette (0.39.2)
starlette PYPI version 0.39.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - assistant-stream 0.0.1 - mirapi =0.0.1.dev0, =0.0.3 - nlip 0.1.0 - pyonir 0.0.4 - scout-runtime 0.1.0 - starlette-authlib 0.3.2 Source cves:...
Malicious code in libsc-runtime-telemetry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280cf690237f367f57670f695c85d84227b06c563f5f1c1c3f69d437c52cbfe4 Importing libsc-runtime-telemetry auto-invokes a bootstrap routine that schedules a periodic job collecting host identity hostname, public IP, revers...
EUVD-2026-37224
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime Security. Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...
EUVD-2026-37231
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime Security. Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet10.0: aspnetcore-runtime-10.0-10.0.9-1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-10.0-10.0.9-1.hum1 aarch64, x8664 aspnetcore-targeting-pack-10.0-10.0.9-1.hum1 aarch64, x8664...
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Summary The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDGRUNTIMEDIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-/daemon.pid. Because the write does not us...
GHSA-3PVJ-JV98-QHJQ Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Summary The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDGRUNTIMEDIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-/daemon.pid. Because the write does not us...