[SECURITY] Fedora 42 Update: python3.14-3.14.4-2.fc42

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.14 package provides the "python3.14" executable:...

oriole-test (0.2.2) potentially affected by CVE-2026-6357 via pip (9.0.2)

pip PYPI version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - oriole-test 0.2.2 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.29.0, <=3.33.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.0)

org.apache.camel:camel-consul MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.0 Source cves: CVE-2026-27172 Source advisory: OSV:GHSA-5RC6-9QFP-8VWG...

org.apache.camel.kafkaconnector:camel-consul-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.karaf:camel-consul (>=4.7.0, <=4.14.5) +7 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=3.0.0, <=4.14.5)

org.apache.camel:camel-consul MAVEN version =3.0.0, =0.1.0, =4.7.0, =4.8.1, =1.0.0-m3, =1.0.0-m3, =1.0.0-m3, =4.6.0, =3.0.0, =4.14.5 - org.wildfly.camel:wildfly-camel-itests-standalone-docker 12.0.0 Source cves: CVE-2026-27172 Source advisory: OSV:GHSA-5RC6-9QFP-8VWG...

org.apache.camel.quarkus:camel-quarkus-consul (>=3.29.0, <=3.33.0), org.apache.camel.quarkus:camel-quarkus-consul-deployment (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-27172 via org.apache.camel:camel-consul (>=4.15.0, <=4.18.0)

org.apache.camel:camel-consul MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =4.18.0 Source cves: CVE-2026-27172 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321641...

org.apache.camel.karaf:camel-activemq (4.18.1), org.apache.camel.quarkus:camel-quarkus-activemq (>=3.29.0, <=3.33.0) +3 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (>=4.15.0, <=4.18.1)

org.apache.camel:camel-activemq MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40860 Source advisory: GHSA-M5VH-3FW5-5WGH...

Exploit for CVE-2026-0911

CVE-2026-0911 — Hustle modül import PoC WordPress eklentisi...

python-ecdsa DER Parser Security Test Suite

This Python script is a security test and validation suite for the python-ecdsa library, focused on detecting potential DER Distinguished Encoding Rules parsing anomalies that may relate to CVE-2026-33936...

Detecting Avalanche Effect in Adversarial Settings: Spotting the Encryption Loops in Ransomware

Spotting encryption loops in binary-only ransomware is a critical reverse engineering task. Since the existence of avalanche effect, an intrinsic characteristic of any secure encryption algorithms, is unavoidable during a victim data encryption attack, it is a very promising direction to spot...

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

GHSA-V4P8-MG3P-G94G LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

CVE-2026-31676

The CVE-2026-31676 issue concerns the Linux kernel’s rxrpc subsystem. A flaw allowed duplicate or late RESPONSE packets to be processed outside the intended RXRPC_CONN_SERVICE_CHALLENGING state. The fix enforces state-checking under a state_lock before performing response verification and securit...

[SECURITY] Fedora 44 Update: python3.13-3.13.13-1.fc44

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.13 package provides the "python3.13" executable:...

[SECURITY] Fedora 44 Update: python3.9-3.9.25-7.fc44

Python 3.9 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.9 package provides the "python3.9" executable: the...

OSV-2026-623 Use-of-uninitialized-value in Mat_PrintNumber

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903317 Crash type: Use-of-uninitialized-value Crash state: MatPrintNumber MatPrintData MatVarPrint...

PT-2026-37185

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.74.2 through 1.83.6 Description LiteLLM, a proxy server for Large Language Model APIs, contains a flaw where two endpoints used to preview an MCP server before saving it accept a full server configuration in the request body...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), de.gematik.test.tiger:tiger-on-fhir (>=1.1.1, <=1.2.1) +6 more potentially affected by CVE-2026-42037 via org.webjars.npm:axios (>=1.4.0, <=1.7.2)

org.webjars.npm:axios MAVEN version =1.4.0, =2.0.0, =1.1.1, =2.1.1, =2.1.1, =2.1.1, =2.1.3, =2.1.1, =1.0.6, =1.0.9 Source cves: CVE-2026-42037 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16299820...

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Impact The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user cou...

GHSA-XQMJ-J6MV-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Impact The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user cou...

Improper Neutralization of Special Elements Used in a Template Engine

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the POST /prompts/test endpoint, which accepts user-supplied prompt templates and renders them...