18032 matches found
PYSEC-2026-1073 Malicious code in orchestr8-platform (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of orchestr8-platform were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...
PYSEC-2026-1071 Malicious code in mem8 (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of mem8 were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and attemp...
PYSEC-2026-1070 Malicious code in langchain-core-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of langchain-core-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...
PYSEC-2026-1352 ExecuTorch vulnerable to Heap-based Buffer Overflow attack
A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f...
PYSEC-2026-1997 urllib3 does not control redirects in browsers and Node.js
urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects. However, the retries...
PYSEC-2026-1929 Skyvern has a Jinja runtime leak
Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py...
PYSEC-2026-2023 vLLM Tool Schema allows DoS via Malformed pattern and type Fields
Summary The vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference...
PYSEC-2026-1069 Malicious code in instructor-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of instructor-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
PYSEC-2026-1068 Malicious code in dreamgen (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of dreamgen were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...
GO-2026-5857 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission...
MAL-2026-7437 Malicious code in web3-runtime-engine (npm)
--- -= Per source details. Do not edit below this line.=-...
SUSE-SU-2026:22545-1 Security update for jq
This update for jq fixes the following issues: - CVE-2025-48060: improper handling of string data in jvstringempty can lead to heap buffer overflow and a crash when processing crafted input bsc1244116. - CVE-2026-32316: integer overflow within the jvpstringappend and jvpstringcopyreplacebad...
PYSEC-2026-1479 jupyter-scheduler's endpoint is missing authentication
Impact jupyterscheduler is missing an authentication check in Jupyter Server on an API endpoint GET /scheduler/runtimeenvironments which lists the names of the Conda environments on the server. In affected versions, jupyterscheduler allows an unauthenticated user to obtain the list of Conda...
PYSEC-2026-1858 `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code
Summary deserializing json data using qiskitibmruntime.RuntimeDecoder can be made to execute arbitrary code given a correctly formatted input string Details RuntimeDecoder is supposed to be able to deserialize JSON strings containing various special types encoded via RuntimeEncoder. However, one...
PyPDF2 quadratic runtime with malformed PDF missing xref marker
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patcheshttps://github.com/py-pdf/pypdf/pull/808 WorkaroundsIs...
PYSEC-2026-1837 PyPDF2 quadratic runtime with malformed PDF missing xref marker
Impact An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patches https://github.com/py-pdf/pypdf/pull/808 Workarounds ...
CVE-2026-38976
mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in opsuper / OPSUPER due to a missing runtime guard for top-level super...
kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture aloop driver. This Use-After-Free UAF vulnerability occurs when loopbackcheckformat stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could...
kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture aloop driver. This Use-After-Free UAF vulnerability occurs when loopbackcheckformat stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could...