org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

Important: Red Hat Security Advisory: maven:3.9 security update

An update for the maven:3.9 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

ALSA-2026:38514 Important: plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

ALSA-2026:38796 Important: plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

MAL-2026-10158 Malicious code in notify-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f Package published as notify-utilities masquerades as the pino logger package.json description, keywords, and index.d.ts are copied from pino; the...

TencentOS Server 4: cifs-utils (TSSA-2026:0552)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0552 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-55471

CVE-2026-55471 affects HAPI FHIR: org.hl7.fhir.utilities XsltUtilities.saxsonTransform overloads (XsltUtilities.saxonTransform) prior to 6.9.10. The root cause is the use of a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions, enabl...

CVE-2026-15033 christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...

PT-2026-57873

Name of the Vulnerable Software and Affected Versions Glarysoft Glary Utilities affected versions not specified Description A local privilege escalation flaw exists in the Disk Clean functionality. An attacker with low-privileged code execution capabilities on the target system can create a...

Picklescan vulnerable to Arbitrary File Writing

SummaryPicklescan has got open and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files. DetailsThis is another vulnerability which impacts the downstream user.By...

PYSEC-2026-1986 Transformers's Improper Input Validation vulnerability can be exploited through username injection

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

Transformers's Improper Input Validation vulnerability can be exploited through username injection

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

PYSEC-2026-1576 LLaMA-Factory allows Code Injection through improper vhead_file safeguards

Summary A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vheadfile is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passi...

Malicious code in notifier-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...

MAL-2026-6923 Malicious code in notifier-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...

MAL-2026-7349 Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7104 Malicious code in @xp-utilities/web (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7103 Malicious code in @xp-utilities/utilities (npm)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1774 pgAdmin failed to properly control the server code

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an...