124131 matches found
Malicious code in @sahril2nd/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e This package is a fork of the Baileys WhatsApp library that embeds a hardcoded network destination hidden as a String.fromCharCode... decimal-ASCII...
MAL-2026-16105 Malicious code in @sahril2nd/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e This package is a fork of the Baileys WhatsApp library that embeds a hardcoded network destination hidden as a String.fromCharCode... decimal-ASCII...
lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
Important: Red Hat Security Advisory: python-lxml security update
An update for python-lxml is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
Important: Red Hat Security Advisory: python3.12-lxml security update
An update for python3.12-lxml is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
CVE-2026-87996
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...
DRUPAL-CONTRIB-2026-151
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...
DRUPAL-CONTRIB-2026-135
This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
MAL-2026-16121 Malicious code in websetup (PyPI)
[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...
CVE-2026-73334
A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service KMS Uniform Resource Locator URL is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KM...
git-lfs security update
An update is available for git-lfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, video...
RLSA-2026:64788 Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2026-73334
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2026-73334
The org.apache.parquet.crypto.keytools package in Apache Parquet (versions 1.12 to 1.18) is vulnerable to a Server-side Request Forgery (SSRF) due to a host validation bypass. When the KMS URL is file-controlled rather than application-controlled, the FileKeyUnwrapper forwards the URL to a plugga...
CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...