MAL-2026-9251 Malicious code in wandscal (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wandczvof10git (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vcsfossilpdfx1 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in testssp-wukues (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in swa8402foss (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sprox-c160-4fossil (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sm8230mamd (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in slnwandsmodabc (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rjan2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pwnlambcal3 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oakmi17100 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in oaihx0157786 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lammeet00 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Summary A Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Details enablemessage..., use=False, handle=True only prevents the LLM from being instructed to generate...

CVE-2026-8932

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

EUVD-2026-25018

id: groups= computed from real GID instead of effective GID...

EUVD-2026-24988

mkdir: -m exposes directory with umask perms before chmod race window...

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header

A flaw was found in undici. When undici processes Set-Cookie headers, it incorrectly interprets the SameSite attribute, accepting partial matches instead of exact ones. This allows a malicious server to downgrade a cookie's SameSite policy to a less secure setting, potentially leading to unintend...

EUVD-2026-41843

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header the constant...

CVE-2026-46584

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer MailProducer.getSender scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present...