Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

ImpactThe several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 ReferencesThanks to Yaohui Wang for reporting this via GitHub...

`greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

CVE-2026-84967

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

CVE-2026-84967

The MongoDB extension for Visual Studio Code fails to neutralize special characters in a connection string before embedding it into a command line composed for the Launch MongoDB Shell integrated terminal. An unauthenticated remote attacker who convinces a developer to accept a user-supplied conn...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

Malicious Package

Overview vs-modules is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

EUVD-2026-66712

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups...

CVE-2026-55227

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-55540

CVE-2026-55540 is a path traversal vulnerability in PraisonAI , a multi-agent teams system. The function is_path_within_directory() relies on os.path.abspath() instead of os.path.realpath() to enforce the workspace boundary, so a symlink placed inside the workspace can resolve to a path outside i...

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

PT-2026-81076

Name of the Vulnerable Software and Affected Versions Ashlar-Vellum Cobalt affected versions not specified Description A heap-based buffer overflow exists during the parsing of VS files. The issue occurs because the software fails to properly validate the length of user-supplied data before copyi...

CVE-2025-14602

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

PT-2026-78896

Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0101 Description The application uses a weak and predictable method based on the request timestamp to generate names for uploaded files. This flaw allows a remote attacker to guess or brute-force the generated...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

PT-2026-78532

Name of the Vulnerable Software and Affected Versions The product name cannot be determined versions prior to 14.0101 Description An application component insecurely processes user-supplied parameters by passing them into SQL queries. This flaw allows for blind SQL injection, a technique used to...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...