12541 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-74339
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued...
PT-2026-72775
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer where the snd seq read function copies a queued variable-length event header to userspace before the payload is expanded. While the system removes...
PT-2026-72689
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where the dpi variable is only initialized during the BNXT RE ALLOC WC PAGE process but is subsequently copied across all cases, leading to...
PT-2026-73054
siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...
Pre-Model Representation Failures in GNN-Based Smart Contract Vulnerability Detection
This paper is a failure analysis of the representation layer underlying GNN-based smart contract vulnerability detectors. These systems convert source code into graphs before any learning takes place; if the graph fails to capture the code's semantics, no model improvement can compensate. We...
CVE-2026-49986
The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...
EUVD-2026-58715
The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...
CVE-2026-49986
Summary: CVE-2026-49986 describes a local arbitrary code execution in the Cortex MCP server (neuro-cortex-memory) prior to version 3.17.1. The root cause is permissive validation in _find_dev_source()/ _is_cortex_root(): the code trusts the CLAUDE_PROJECT_DIR environment variable (set by Claude C...
CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...
MAL-2026-14029 Malicious code in axios-fast (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...
Malicious code in alelo-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6 The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, th...
MAL-2026-14024 Malicious code in alelo-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6 The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, th...
Malicious code in notafollower1226 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...
Linux Distros Unpatched Vulnerability : CVE-2026-73622
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secret...
CVE-2026-17077
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable...
CVE-2026-17077
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable...
CVE-2026-17077
IBM i 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-17077 due to the use of an uninitialized variable in DRDA/DDM processing, enabling a remote attacker to cause a denial of service (CVSS v3.1 base score 5.3). The IBM security bulletin lists remediation by applying PTFs: 7.6 SJ10848, 7.5 SJ1084...
CVE-2026-17077 IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable...