MAL-2026-17926 Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

CVE-2026-109437: Initialization of a Resource with an Insecure Default

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-111406: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

PT-2026-118000

Summary A missing comma in mercury app/block handler.py's BLOCKED PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury...

CVE-2026-111057: Incorrect Regular Expression

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKEDPATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint...

PT-2026-117407

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

Oracle Linux 10 : emacs (ELSA-2026-84591)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-84591 advisory. - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 - tramp: restrict user name to prevent shell injection CVE-2026-79992...

Joern 4.0.659

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-112263: Improper Neutralization of Special Elements used in an OS Command

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

PT-2026-117300

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

emacs security update

1:29.4-16 - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 1:29.4-15 - tramp: restrict user name to prevent shell injection CVE-2026-79992 1:29.4-14 - image: fix integer overflow in pbmload CVE-2026-77219...

Exploit for CVE-2026-98256

InfinityCore Android — CVE-2026-98256 Signal Overvie...

PT Norther Lights Production Map – SVG file upload vulnerability

PT Norther Lights Production Map: Versions prior to SVG 8.16.1 have an arbitrary file upload vulnerability. This vulnerability stems from allowing the upload of dangerous types of files, which may lead to the uploading of a Web Shell to the web server...

CognicellAI Cognition configuration error vulnerability

CognicellAI Cognition versions prior to 0.13.0 have a security vulnerability. This vulnerability stems from the default setting of having the agent sandbox backend executed locally, and the REST/SSE API not enabling authentication. Attackers can create sessions using the POST /sessions endpoint...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Arm Bifrost_Gpu_Kernel_Driver

Sony XBR-65X850D — Root & Persistence Local privilege es...

Kioptrix-Level-1-POC

🎯 Kioptrix Level 1 — Method 1: Apache modssl OpenFuck Tar...

Exploit for CVE-2026-8933

CVE-2026-8933 — snap-confine mount-namespace race → local ro...

CLSA-2026-1792197391 openssh: Fix of 8 CVEs

CVE-2026-106555: sshd kept GSSAPI client state from a partially completed GSSAPIAuthentication attempt and could reuse it in a later attempt; reset the global GSSAPI client state before each authentication attempt. Backport upstream commit 670510d1. - CVE-2026-106553: sshd could store delegated...

Joern 4.0.658

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...