112502 matches found
Malicious code in soundsource (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3285c5fec24c01c9c463e85c199934f5a08da7e94277583430a6e3feb274add The package's source distribution contains Token.txt at the tarball root holding a live PyPI API token prefix pypi-AgEIcHlwaS5vcmc.... Anyone who...
MAL-2026-4769 Malicious code in soundsource (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3285c5fec24c01c9c463e85c199934f5a08da7e94277583430a6e3feb274add The package's source distribution contains Token.txt at the tarball root holding a live PyPI API token prefix pypi-AgEIcHlwaS5vcmc.... Anyone who...
Malicious code in workrally (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502275ca25c6fb0e28db57d91789be11e347b5f21696ed45e15c015d123eaf51 dist/index.js imports childprocess and runs whoami observed at multiple call sites, then POSTs the result to a hardcoded remote URL...
Malicious code in alya-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 473103f2220a0215abf49be7e46ec1748052935ce188e0eee6ded08af7b47cf1 alya-baileys is a fork of the Baileys WhatsApp library that adds a hidden, remotely-controlled action channel against the installer's authenticated...
MAL-2026-4478 Malicious code in alya-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 473103f2220a0215abf49be7e46ec1748052935ce188e0eee6ded08af7b47cf1 alya-baileys is a fork of the Baileys WhatsApp library that adds a hidden, remotely-controlled action channel against the installer's authenticated...
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API
A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
Important: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-31380
creationtimestamp| type| source ---|---|--- 2026-05-19 18:20:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7yyrj2ym2j...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
CLSA-2026-1779213441 python3.11: Fix of 11 CVEs
CVE-2026-4224: avoid unbound C recursion in convcontentmodel in pyexpat - CVE-2026-3644: reject control characters in http.cookies.Morsel.update - CVE-2026-0672: reject control characters in http.cookies.Morsel - CVE-2025-8291: check consistency of zip64 end of central directory record -...
CVE-2026-43634
creationtimestamp| type| source ---|---|--- 2026-05-19 17:49:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7xbcixbu2e 2026-05-20 00:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmalyh2pwc2k...
CVE-2026-2586
creationtimestamp| type| source ---|---|--- 2026-05-19 17:48:55+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mm7x7isn7i2q 2026-05-20 01:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmapdmmvoi2n 2026-05-21 14:37:07+00:00| seen|...
CVE-2026-44159
creationtimestamp| type| source ---|---|--- 2026-05-19 17:44:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7wye2wgz2t 2026-05-20 01:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmapdezgul2s...
CVE-2026-33637
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...
CVE-2026-41919
creationtimestamp| type| source ---|---|--- 2026-05-19 17:41:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7wrnouyr24 2026-05-31 11:01:36+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mn5g27u6d32g...
CVE-2026-8968
creationtimestamp| type| source ---|---|--- 2026-05-19 17:20:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7vmus2yd2v 2026-05-19 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260520 2026-05-20 02:00:41+00:00| seen|...