CVE-2026-54888

The CVE-2026-54888 issue is a denial-of-service in mdex/mdex_native caused by uncontrolled recursion when converting Markdown to an AST across a NIF boundary. The root cause is missing maximum nesting depth in two mutual Rust functions (ex_document_to_comrak_ast and comrak_ast_to_ex_document), al...

CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding render: fullinfostring: true are enabled, t...

CVE-2026-13746

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the...

CVE-2026-13751 Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. B...

CVE-2026-13744

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL i...

CVE-2026-13744 Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL i...

CVE-2026-46406

Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation, randomness, or symlink protection. The file was created world-readable 0644 in a world-traversable...

CVE-2026-55607

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...

@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +13 more potentially affected by CVE-2026-55607 via @anthropic-ai/claude-code (>=2.1.39, <=2.1.154)

@anthropic-ai/claude-code NPM version =2.1.39, =1.0.0, =0.0.1, =0.7.5, =0.6.0-beta.3, =1.30.1-broken.0, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =0.0.2, =1.2.2, =1.2.3 Source cves: CVE-2026-55607 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-17817924...

CVE-2026-57337

CVE-2026-57337 affects the WordPress Landing Page Builder plugin with versions up to and including 1.5.3.5. The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, allowing an attacker to inject and execute script in the context of affected sites. The CVSS v3.1 base score is 7.1 ...

CVE-2026-57330

The CVE-2026-57330 entry describes a Cross-Site Scripting (XSS) vulnerability in the WordPress MasterStudy LMS plugin, affecting versions

PYSEC-2026-393 Unsafe yaml deserialization in llama-hub

The OpenAPI and ChatGPT plugin loaders in LlamaHub aka llama-hub before 0.0.67 allow attackers to execute arbitrary code because safeload is not used for YAML...

PYSEC-2026-369 Keras code injection vulnerability

A arbitrary code injection vulnerability in TensorFlow's Keras framework 2.13 allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application...

PYSEC-2026-336 ExecuTorch vulnerable to Heap-based Buffer Overflow

A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c...

PYSEC-2026-440 OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...

Security Bulletin: IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled

Summary IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled CVE-2026-9002 Vulnerability Details CVEID:CVE-2026-9002 DESCRIPTION: IBM WebSphere eXtreme Scale could allow an adjacent attacker to cause a denial of service due to improper validation in th...

PT-2026-53300

Name of the Vulnerable Software and Affected Versions Business Directory versions prior to 6.4.24 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 6.4.23...

khoj-assistant (>=1.21.0, <=1.21.1) potentially affected by CVE-2026-13508 via khoj (1.42.10)

khoj PYPI version 1.42.10 is affected by a known vulnerability. The following packages have a transitive dependency on khoj and may be impacted: - khoj-assistant =1.21.0, =1.21.1 Source cves: CVE-2026-13508 Source advisory: SNYK:PYTHON-KHOJ-17756762...

airflow-provider-skypilot (0.1.3), autodistill-efficient-yolo-world (>=0.1.0, <=0.1.1) +30 more potentially affected by CVE-2026-13482 via skypilot (>=0.2.2, <=0.13.0)

skypilot PYPI version =0.2.2, =0.1.0, =0.1.2.dev0, =0.1.4, =0.12.0, =0.1.4, =0.1.1, =0.9.9, =0.9.9rc23, =0.9.9rc23, =0.9.9, =0.9.9, =1.0.2, =0.1.0, =0.12.1 and more Source cves: CVE-2026-13482 Source advisory: SNYK:PYTHON-SKYPILOT-17675441...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the GoTarget function in the gofmt component. An attacker can execute arbitrary system commands by manipulating input passed to this function from a local environment. Remediation There is no fixed versio...