Malicious code in wandczvof10git (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vcsfossilpdfx1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in testssp-wukues (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swa8402foss (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sprox-c160-4fossil (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sm8230mamd (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slnwandsmodabc (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rjan2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pwnlambcal3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oakmi17100 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaihx0157786 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lammeet00 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Apache HDFS Provider error message suggested

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentationinfo pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The...

PYSEC-2026-1177 Apache Superset Improper Input Validation vulnerability

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Summary A Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Details enablemessage..., use=False, handle=True only prevents the LLM from being instructed to generate...

CVE-2026-8932

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

EUVD-2026-25018

id: groups= computed from real GID instead of effective GID...

GHSA-47C7-QRM7-MQW7 id: groups= computed from real GID instead of effective GID

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes...

EUVD-2026-24988

mkdir: -m exposes directory with umask perms before chmod race window...

GHSA-XJ53-J257-HXVG OpenRemote read-only asset users can write predicted datapoints

Summary The predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. The endpoint: text PUT /api/realm/asset/predicted/assetId/attributeName accepts write requests from users lacking write:assets. The implementation appears to check READASSET...