123175 matches found
MAL-2026-8254 Malicious code in oaijgitwelcpe (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lp489 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lambjanonlym (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-2060 ydata cross-site scripting
A cross-site scripting XSS vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser...
PYSEC-2026-1653 mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
mlflow Path Traversal vulnerability
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...
PYSEC-2026-1650 mlflow Path Traversal vulnerability
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...
PYSEC-2026-2033 WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. Patches Fixed by 734ee8e that’s included in 61.2 Workarounds - Check that no PDF...
Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...
Null pointer dereference in PKCS12 parsing
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSLto crash leading to a potential Denial of Service attackImpact summary: Applications loading files in the PKCS12 format from untrustedsources might terminate abruptly.A file in PKCS12 format can contain certificates and...
Cross-Site Request Forgery vulnerability in Prefect
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API...
PYSEC-2026-1799 Cross-Site Request Forgery vulnerability in Prefect
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API...
CVE-2026-14476
creationtimestamp| type| source ---|---|--- 2026-07-07 11:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2iytgfgd2a 2026-07-20 13:12:20+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mr3enz3dlw2l 2026-07-20 14:14:46+00:00| seen|...
CVE-2026-14868
creationtimestamp| type| source ---|---|--- 2026-07-07 11:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2i5wspmi2b 2026-07-14 22:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnbgflw2623...
soroban_verify_poc
Soroban Verify PoC This repository is an ultra-minimal proof-...
CVE-2026-11348 Authentication Bypass in HAVELSAN's Open Source Project Liman MYS
Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...
EUVD-2026-42034
Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...
CVE-2026-11348
The CVE-2026-11348 vulnerability affects HAVELSAN Liman MYS (before release.Master.1107) and is caused by improper verification of a cryptographic signature. The entry indicates a remote attack vector (Network) with high impact across confidentiality, integrity, and availability (CVSS v3.1: 8.1, ...
agave (>=0.0.1.dev0, <=0.0.2.dev0), mexcalli (>=0.0.0.1.dev0, <=0.0.0.2.dev0) +5 more potentially affected by CVE-2023-28117 via sentry-sdk (0.16.5)
sentry-sdk PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - agave =0.0.1.dev0, =0.0.0.1.dev0, =0.5.0a6, =0.1.1, =1.2.0, =1.4.0 - tg-odesli-bot 0.2.8 Source cves: CVE-2023-28117 Source advisory:...