MAL-2026-10993 Malicious code in torch-musa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc7f99306afb7d31dab4c2ca32f2feb984bcdc505cf1dc6c3ee736cd21f9bcc9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

GHSA-G3R5-9H93-4J2C n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Impact A TOCTOU race condition in the Git node's clone operation lets an authenticated user bypass its path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This plants a crafted repository in the community node directory, which n8n loads a...

CVE-2026-13187

creationtimestamp| type| source ---|---|--- 2026-07-22 17:18:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrategwpze2g...

CVE-2026-64834 FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...

CVE-2026-64834

FFmpeg 0.6.3–8.1.2 contains an infinite loop DoS in the RTP/ASF demuxer (libavformat/rtpdec_asf.c). The rtp_asf_fix_header function does not validate a minimum chunksize when iterating ASF objects, so when a chunksize is smaller than the 24-byte ASF header, the loop pointer fails to advance, caus...

CVE-2026-11605

creationtimestamp| type| source ---|---|--- 2026-07-22 16:47:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u 2026-07-22 19:01:40+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o...

CVE-2026-59678

creationtimestamp| type| source ---|---|--- 2026-07-22 16:26:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mraqhvveol26...

CERTFR-2026-ALE-008

creationtimestamp| type| source ---|---|--- 2026-07-22 15:03:13+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116964235036563174...

GHSA-537C-GMF6-5CCF

creationtimestamp| type| source ---|---|--- 2026-07-22 14:30:53+00:00| seen| https://infosec.exchange/users/mmguero/statuses/116964108001076474...

CVE-2026-50251

creationtimestamp| type| source ---|---|--- 2026-07-22 14:17:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrajb6qfzh2o...

CVE-2026-42955

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

CVE-2026-42955

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

CVE-2026-42955

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

EUVD-2026-47666

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

CVE-2026-42955 Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

CVE-2026-14586

CVE-2026-14586 affects NLnet Labs Unbound 1.22.0–1.25.1 in DNS-over-QUIC (DoQ) environments under high concurrency. The root cause is an assertion in libngtcp2 related to monotonic timestamps; Unbound used realtime, which can trigger an assertion in libngtcp2 for the QUIC timestamp, potentially t...

CVE-2026-14586 Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for...

GHSA-725Q-C4VP-Q4CG Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g3r5-9h93-4j2c. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allow...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-4773 OTP Bypass in Magarsus' IDM-MFA

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...