[UPDATE] [critical] Python: Vulnerability allows code execution
An attacker can exploit a vulnerability in Python to execute arbitrary program code.
Advisories tracked
21,344
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,787
Sources online
24
Last sync
1H AGO
[NEW] [high] Juniper JUNOS and JUNOS Evolved: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Juniper JUNOS, JUNOS Evolved, Juniper EX Series, Juniper MX Series, Juniper QFX Series, and Juniper SRX Series to cause a Denial of Service condition, disclose information, execute code, and trigger undefined behavior.
NCSC-2026-0223 [1.00] [M/H] Vulnerabilities fixed in BeyondTrust Remote Support and Privileged Remote Access
BeyondTrust has fixed vulnerabilities in the products Remote Support and Privileged Remote Access. The vulnerabilities affect multiple aspects of the products Remote Support and Privileged Remote Access. There is a pre-authentication vulnerability that allows a network-based atta…
NCSC-2026-0222 [1.00] [M/H] Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition
GitLab has fixed multiple vulnerabilities in GitLab Enterprise Edition (EE) and Community Edition (CE) in versions ranging from 9.1 to before 18.11.7, 19.0 to before 19.0.4, and 19.1 to before 19.1.2. The vulnerabilities include: - Creating repositories with discrepancies between…
[UPDATE] [high] Microsoft Malware Protection Engine: Vulnerability allows privilege escalation
A local attacker can exploit a vulnerability in Microsoft Malware Protection Engine and Microsoft Defender to elevate their privileges.
[UPDATE] [critical] Flowise: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Flowise to execute arbitrary code and to disclose information.
GHSA-28jh-g32x-v9v4: Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
Summary Tesla.Multipart.part_headers_for_disposition/1 interpolates Content-Disposition parameter values (field name, filename, and other opts) verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name…
GHSA-h74c-q9j7-mpcm: Tesla vulnerable to atom exhaustion via untrusted URL scheme
Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.open_conn/2 passes the URL scheme of every outgoing request through String.to_atom/1 with no allow-list validation. Because BEAM atoms are permanent (never garbage-collected) and the atom table is …
GHSA-9m9w-gxf7-rh8m: Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as suppli…
GHSA-mc85-72gr-vm9f: Tesla has decompression bomb on response body
Summary Any Tesla client pipeline that includes Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression eagerly decompresses HTTP response bodies with no size limit. A server under attacker control (or reached via a redirect) can return a tiny gzip-encoded payload th…
GHSA-q7jx-v53g-848w: Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
Summary Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart Content-Type header with no validation. A param value containing \r\n splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary paramet…
CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
Multiple vulnerabilities in Progress MOVEit Transfer (July 10, 2026)
Multiple vulnerabilities have been discovered in Progress MOVEit Transfer. Some of them allow an attacker to cause privilege escalation, data confidentiality breaches, and remote indirect code injection (XSS).
Vulnerability in NetApp ONTAP 9 (July 10, 2026)
A vulnerability has been discovered in NetApp ONTAP 9. It allows an attacker to cause remote denial of service and data integrity breaches.
Multiple vulnerabilities in Microsoft Azure Linux (July 10, 2026)
Multiple vulnerabilities have been discovered in Microsoft Azure Linux. They allow an attacker to cause an unspecified security issue by the vendor.
Multiple vulnerabilities in SUSE Linux kernel (July 10, 2026)
Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause data confidentiality breaches, data integrity breaches, and security policy bypass.
DSA-6386-1 opam - security update
Kate Deplaix reported that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. Installing files through .install files did not check symlinks resolution on the target path, which could result in directory traversal out of the package area…
CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Multiple vulnerabilities in IBM products (July 10, 2026)
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote denial of service, data confidentiality breaches, and server-side request forgery (SSRF).
Vulnerability in CPython (July 10, 2026)
A vulnerability has been discovered in CPython. It allows an attacker to cause remote denial of service.
Multiple vulnerabilities in Ubuntu Linux kernel (July 10, 2026)
Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, data confidentiality breaches, and security policy bypass.
Multiple vulnerabilities in Siemens products (July 10, 2026)
Multiple vulnerabilities have been discovered in Siemens products. Some of them allow an attacker to cause arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities in Red Hat Linux kernel (July 10, 2026)
Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities in Debian LTS Linux kernel (July 10, 2026)
Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, data confidentiality breaches, and denial of service.
Multiple vulnerabilities in Suricata (July 10, 2026)
Multiple vulnerabilities have been discovered in Suricata. They allow an attacker to cause an unspecified security issue by the vendor.
GHSA-qcq2-496w-v96p: Mistune: Potential DoS via quadratic-time parsing in parse_link_text
Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown. Affected component mistune/inline_parser.py → **parse_lin…
GHSA-frrj-87jh-2772: GoBGP confederation validation panics on empty AS_PATH attribute
Found through variant analysis based on CVE-2026-41643 Summary GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that s…
GHSA-gjrg-jjr3-56cm: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
Summary GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, CapLen. A malformed BGP OPEN message can cause bytes from…
GHSA-2rmg-vrx8-9j2f: psd-tools vulnerable to arbitrary file write via smart-object filename
psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools (all releases exposing the SmartObject API through v1.17.0), SmartObject.save() writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-co…
GHSA-9vcr-p3rj-q5q6: sigstore-go has a multi-log threshold bypass via single compromised log
Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witness…
GHSA-h672-p7h7-97v9: Rattler vulnerable to package cache path traversal via conda package build string
rattler_cache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the ratter_cache code used the package record build string as part of a cache key that was joined into a filesystem path…
GHSA-h5g6-xmh4-hc37: OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
Summary The restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. Details In the current project, the referrer header value is used for subsequent redirects, so there is currently a validation for this redirect value. The curre…
GHSA-g586-ccqf-7x4r: mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
Summary Mint's HTTP/2 client accepts PUSH_PROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting max_concurrent_streams. A malicious or compromised HTTP/2 server can flood the client with PUSH_PROMISE frames a…
GHSA-2p26-p43x-fhp8: mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)
Summary Mint's HTTP/2 client accumulates CONTINUATION header-block fragments into a per-connection buffer with no cap on size or frame count. A malicious or compromised HTTP/2 server can drive the client's memory to arbitrary size by streaming an endless chain of CONTINUATION fr…
GHSA-mjqx-c6f6-7rc2: mint: Content-Length header accepts non-RFC "+" sign prefix
Summary Mint's HTTP/1 client accepts Content-Length header values with a leading + sign (e.g. +0, +123), which RFC 7230 forbids (Content-Length = 1*DIGIT). On a connection shared with a strict fronting proxy or load balancer, this parser disagreement is a response-smuggling prim…
GHSA-2pg6-44cx-c49v: mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`
Summary Mint's HTTP/1 request encoder splices the caller-supplied method and target directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to Mint.HTTP.request/5 is exposed to request-l…
GHSA-g9xf-7f8q-9mcj: pypdf: Possible infinite loop when processing threads/articles in writer
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the chan…
GHSA-mr9r-h354-966r: Sylius: IDOR on Shop Payment Request API endpoints
Impact The GET /api/v2/shop/payment-requests/{hash} and PUT /api/v2/shop/payment-requests/{hash} endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obt…
GHSA-6955-hrm5-c4qp: Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Impact An authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (st…
GHSA-5597-7rmh-97q5: Sylius: Cart FormComponent allows modification or deletion of an already-completed order
Impact A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes the status, or the user finalizes payment in another tab. The browser still displays the old cart: the LiveComponent is unaware the underlying order state has chan…
GHSA-px5m-h76g-p7p8: YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. Th…
GHSA-9369-69wj-7m2f: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
Details Sink tools/bazar/services/CSVManager.php line 372-399: public function importEntry(array $importedEntries, string $formId): ?array { if (!$this->importdone) { // ... foreach ($importedEntries as $entry) { $entry = unserialize(base64_decode($entry)); // <-- SINK $entry …
GHSA-4pf7-cc4r-g63h: YesWiki has Authenticated SQL Injection via ReactionManager
Summary YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated dir…
GHSA-r5xw-gcgw-hwp5: YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitr…
GHSA-35f3-pg38-486f: YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`
Summary YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still …
GHSA-xc7j-3g8q-9vh4: YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts — stored XSS in form renders (sibling class of commit e6b66aa) CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation, "Cross-site Scripting") v…
GHSA-8f2v-2qhj-gfwg: YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Summary ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including sin…
GHSA-qg78-vmvc-fhjw: YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or…
GHSA-vw42-752g-5mrp: YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
Summary The POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, befor…
GHSA-mv28-wj57-f57g: YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Summary HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: | return | meaning | !return | | ------ | ------------------…