https://radar.offseq.com/threat/vulnerability-in-drupal-payumoney-for-drupal-commerce-cve-2026-118564-597cd34fcb3be63c 2026-10-30T07:16:25.738Z weekly 0.7 https://radar.offseq.com/threat/improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-8dfb4afff2d90086 2026-10-30T07:16:23.236Z weekly 0.8 https://radar.offseq.com/threat/external-control-of-file-name-or-path-vulnerability-in-drupal-single-content-sync-allows-path-cve-2026-e42247a81b10c0dd 2026-10-30T07:16:20.288Z weekly 0.8 https://radar.offseq.com/threat/improper-verification-of-cryptographic-signature-vulnerability-in-drupal-commerce-stripe-allows-cve-cb7f827d3efc749f 2026-10-30T07:15:41.587Z weekly 0.8 https://radar.offseq.com/threat/incorrect-authorization-vulnerability-in-drupal-fasttoggle-allows-forceful-browsing-cve-2026-118569-75d38bc9c4b7a1bb 2026-10-30T07:15:38.820Z weekly 0.8 https://radar.offseq.com/threat/use-of-web-browser-cache-containing-sensitive-information-vulnerability-in-drupal-media-alias-display-a0db43a3d7321e35 2026-10-30T07:15:35.992Z weekly 0.7 https://radar.offseq.com/threat/cross-site-request-forgery-csrf-vulnerability-in-drupal-fasttoggle-allows-cross-site-request-forgery-ffa040266f26b6d1 2026-10-30T07:15:31.527Z weekly 0.7 https://radar.offseq.com/threat/insecure-storage-of-sensitive-information-vulnerability-in-drupal-content-sync-content-syncio-cve-2026-f971371a56d43d77 2026-10-30T07:15:28.341Z weekly 0.8 https://radar.offseq.com/threat/authentication-bypass-using-an-alternate-path-or-channel-vulnerability-in-drupal-oauth-login-oauth-cve-b985b6c343ec218b 2026-10-30T07:15:25.512Z weekly 0.8 https://radar.offseq.com/threat/missing-authorization-vulnerability-in-drupal-oauth2-token-manager-allows-forceful-browsing-cve-2026-436d0c2ab1d49826 2026-10-30T07:15:21.413Z weekly 0.7 https://radar.offseq.com/threat/the-export-and-import-users-and-customers-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-a6b84682192add8b 2026-10-30T07:01:05.376Z weekly 0.8 https://radar.offseq.com/threat/authentication-bypass-using-an-alternate-path-or-channel-vulnerability-in-drupal-captcha-allows-cve-41c327aa1ec3ef15 2026-10-30T07:15:18.314Z weekly 0.8 https://radar.offseq.com/threat/improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-cve-a45ac314efd44476 2026-10-30T07:15:15.090Z weekly 0.8 https://radar.offseq.com/threat/incorrect-authorization-vulnerability-in-drupal-field-permissions-allows-forceful-browsing-cve-2026-6289de8778e4d048 2026-10-30T07:15:11.986Z weekly 0.8 https://radar.offseq.com/threat/missing-authorization-vulnerability-in-drupal-xray-audit-allows-forceful-browsing-cve-2026-96389-387a41d35c18e3eb 2026-10-30T07:15:09.366Z weekly 0.8 https://radar.offseq.com/threat/improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-6d808c03449f7473 2026-10-30T07:15:04.822Z weekly 0.8 https://radar.offseq.com/threat/incorrect-permission-assignment-for-critical-resource-vulnerability-in-drupal-s3-file-system-allows-d60ae907cec85cf9 2026-10-30T07:15:01.209Z weekly 0.7 https://radar.offseq.com/threat/incorrect-authorization-vulnerability-in-drupal-field-permissions-allows-forceful-browsing-cve-2026-01e35305dfe3b79e 2026-10-30T07:14:58.590Z weekly 0.7 https://radar.offseq.com/threat/a-flaw-was-found-in-glib-networking-cve-2026-103963-4c49e0d6aa08b70e 2026-10-30T07:01:01.908Z weekly 0.8 https://radar.offseq.com/threat/the-page-and-post-restriction-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-in-all-8ff8e54c7fcca92e 2026-10-30T07:14:55.801Z weekly 0.7 https://radar.offseq.com/threat/the-firelight-lightbox-wordpress-plugin-before-2323-does-not-escape-the-url-of-links-it-opens-in-its-688714429d2ee034 2026-10-30T07:14:50.938Z weekly 0.8 https://radar.offseq.com/threat/the-events-made-easy-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-width-5db82eed49460563 2026-10-30T07:14:47.948Z weekly 0.7 https://radar.offseq.com/threat/the-enable-media-replace-wordpress-plugin-before-423-does-not-restrict-the-classes-allowed-when-fdacc9d9a9ac3d5c 2026-10-30T07:02:25.605Z weekly 0.8 https://radar.offseq.com/threat/the-user-frontend-wordpress-plugin-before-4314-does-not-sanitise-and-escape-some-user-supplied-values-e34741af24582b1c 2026-10-30T07:02:22.147Z weekly 0.7 https://radar.offseq.com/threat/the-content-egg-plugin-for-wordpress-is-vulnerable-to-unauthorized-modification-of-data-due-to-a-54776dc4903e0d8e 2026-10-30T07:02:18.967Z weekly 0.7 https://radar.offseq.com/threat/the-cool-formkit-lite-advanced-form-builder-for-elementor-plugin-for-wordpress-is-vulnerable-to-stored-22ffa9649d4b41cb 2026-10-30T07:02:15.457Z weekly 0.7 https://radar.offseq.com/threat/the-buddyforms-wordpress-plugin-before-2103-does-not-check-that-the-requester-is-allowed-to-manage-a-d2dae6865929e842 2026-10-30T07:02:12.136Z weekly 0.8 https://radar.offseq.com/threat/the-security-plugin-firewall-malware-scanner-with-auto-removal-wordpress-plugin-before-2191-does-not-953a07ac2bedcd98 2026-10-30T07:02:09.304Z weekly 0.8 https://radar.offseq.com/threat/the-joinchat-wordpress-plugin-before-642-does-not-escape-the-message-of-its-button-block-before-5b23c82d784ff6db 2026-10-30T07:02:05.953Z weekly 0.8 https://radar.offseq.com/threat/the-wp-visitor-statistics-real-time-traffic-wordpress-plugin-before-88-does-not-sanitize-and-escape-5a1687a1e4a37740 2026-10-30T07:02:03.025Z weekly 0.8 https://radar.offseq.com/threat/the-security-plugin-firewall-malware-scanner-with-auto-removal-wordpress-plugin-before-2191-does-not-2b4630aa4f5ca953 2026-10-30T07:02:00.070Z weekly 0.8 https://radar.offseq.com/threat/the-joomsport-for-sports-team-league-football-hockey-more-plugin-for-wordpress-is-vulnerable-to-bef039bcbb15920f 2026-10-30T07:01:56.049Z weekly 0.7 https://radar.offseq.com/threat/the-buddyforms-wordpress-plugin-before-2101-does-not-verify-that-a-user-editing-an-existing-entry-is-a432f0dc486a68b3 2026-10-30T07:01:52.748Z weekly 0.8 https://radar.offseq.com/threat/the-fraud-prevention-for-woocommerce-and-edd-wordpress-plugin-before-236-does-not-check-that-a-user-is-664410404b95ce4c 2026-10-30T07:01:49.899Z weekly 0.7 https://radar.offseq.com/threat/the-content-egg-affiliate-product-importer-price-comparison-plugin-for-wordpress-is-vulnerable-to-e44b0d145bd62516 2026-10-30T07:01:47.231Z weekly 0.7 https://radar.offseq.com/threat/the-forminator-forms-plugin-for-wordpress-is-vulnerable-to-limited-file-deletion-in-all-versions-up-4f4b0f14396da454 2026-10-30T07:01:43.384Z weekly 0.7 https://radar.offseq.com/threat/the-wp-visitor-statistics-real-time-traffic-wordpress-plugin-before-88-does-not-sanitize-and-escape-a-d7fdfbc7c7613095 2026-10-30T07:01:39.952Z weekly 0.8 https://radar.offseq.com/threat/cve-2026-114690-out-of-bounds-write-in-red-hat-red-hat-enterprise-linux-10-63d8c63608a98e3a 2026-10-30T07:13:04.008Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-114691-integer-overflow-or-wraparound-in-red-hat-red-hat-enterprise-linux-10-5d14e7006ddb6a27 2026-10-30T07:13:05.891Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-115455-out-of-bounds-write-in-red-hat-red-hat-enterprise-linux-10-aa4ddaa3c225e97a 2026-10-30T07:13:06.547Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-3ded9310ef0a4c05 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/apm-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-934ce1b909f689cb 2026-10-29T21:30:32.000Z weekly 0.8 https://radar.offseq.com/threat/apm-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-71b16877642c037b 2026-10-29T21:30:32.000Z weekly 0.8 https://radar.offseq.com/threat/apm-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-ab98ac666cc53dee 2026-10-29T21:30:32.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-bd2b5d3b2ee04eda 2026-10-29T21:30:32.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-8db699ead7281820 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-54541f55d3af5918 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-31a02f50cd345c17 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-4e8a5dde1094fb82 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-ecb9c1de71d9987e 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-47a043f5c7aff462 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-6aed714b2b608ae7 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-2c344bc58ee91dbc 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-f5ddbfa249a61b39 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-564366b3592a2a45 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-c4976167a78b4ed6 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-873957bb67d13d6c 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-2b9550c0023fca90 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-5ef5bc841c9a164b 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-147fc252396a3e9b 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-6c2c51c0029979a4 2026-10-29T21:30:32.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-f5726c6f40c33214 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-9476fc3a9c21560c 2026-10-29T21:30:32.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-path-traversal-and-xss-in-include-directive-cve-2026-115355-b498f0875e01c30f 2026-10-29T21:30:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-f1c3f4d99c1b0839 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-5f780e0fb9bb0f24 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-5fe3ce60fe71b117 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-913825e842bdecc0 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-7860d51a5b673410 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-36277760e83466b3 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-2ae6cca2e3cd6e0a 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-fa7c3529a41eccfb 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-3a2833d53032af75 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-8eb91bcbb7034a79 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-1c732592ed04e847 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-457c667534adfdd1 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-83ddd7bd5607c7d2 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-38676ca9716d4191 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/charm-tools-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-0881e5c7137c6d98 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/charm-tools-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-72b2cc2118cf83f8 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/charm-tools-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-c8961cc7f7b5cd38 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/charm-tools-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-1abba204dc0f3306 2026-10-29T21:30:57.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-32a306b92a9f3100 2026-10-29T21:30:57.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-is-vulnerable-to-directory-traversal-cve-2024-23334-f1c584e6f5d5f34d 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttps-http-parser-the-python-one-not-llhttp-still-overly-lenient-about-separators-cve-2024-33b4151a0014dc65 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-cross-site-scripting-vulnerability-on-index-pages-for-static-file-handling-cve-2024-5ab620385f6d009b 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-denial-of-service-when-trying-to-parse-malformed-post-requests-cve-2024-86ce8e85e7ee9f16 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-in-aiohttp-compressed-files-as-symlinks-are-not-protected-from-path-traversal-cve-2024-42367-9a02217fdc42c8e8 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-has-a-memory-leak-when-middleware-is-enabled-when-requesting-a-resource-with-a-non-c91aa8b04e2def6f 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-allows-request-smuggling-due-to-incorrect-parsing-of-chunk-extensions-cve-2024-52304-9ffad53a6d4204e3 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-is-vulnerable-to-http-requestresponse-smuggling-through-incorrect-parsing-of-chunked-f20b7c3ed8124cb0 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttps-http-parser-autodecompress-feature-is-vulnerable-to-zip-bomb-cve-2025-69223-e7f6ede0f83c5fb4 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttps-unicode-processing-of-header-values-could-cause-parsing-discrepancies-cve-2025-69224-2936083129168ebe 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-has-unicode-match-groups-in-regexes-for-ascii-protocol-elements-cve-2025-69225-d7dca7e62e19fc18 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-brute-force-leak-of-internal-static-le-path-components-cve-2025-69226-349a84cee7d2d0c8 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-dos-when-bypassing-asserts-cve-2025-69227-ec0844442566207a 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-denial-of-service-through-large-payloads-cve-2025-69228-6772ab82ce6784ca 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-dos-through-chunked-messages-cve-2025-69229-781c0798a060f073 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-vulnerable-to-cookie-parser-warning-storm-cve-2025-69230-22277bac825ad4c0 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-8b163c1d609b556c 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-server-lacks-an-initial-requestheader-timeout-cve-2026-111064-4525055fad062ec0 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-connector-pool-exhaustion-via-max-age-overflow-cve-2026-111065-a938e9845ff618c0 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-file-descriptor-exhaustion-in-multipart-requests-cve-2026-111066-b38cd9b8ea69c248 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-absolute-form-request-targets-can-spoof-requestscheme-cve-2026-111748-278c3c2c1917a44c 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-cookie-from-subdomain-can-remove-host-only-scope-from-existing-cookies-cve-2026-111749-9c45080b105f86cb 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-pure-python-parser-request-smuggling-cve-2026-111750-8f5ce4b3c23d3c3f 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-allows-unlimited-trailer-headers-leading-to-possible-uncapped-memory-usage-cve-2026-d38e383ee612d38b 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-affected-by-denial-of-service-dos-via-unbounded-dns-cache-in-tcpconnector-cve-2026-8a28587ed469df0a 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-has-crlf-injection-through-multipart-part-content-type-header-construction-cve-2026-42e23f6ac7c8b42a 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-affected-by-unc-ssrfntlmv2-credential-theftlocal-file-read-in-static-resource-handler-3ca858e291936402 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-has-a-multipart-header-size-bypass-cve-2026-34516-15c557b3bee70f7b 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-has-late-size-enforcement-for-non-file-multipart-fields-causes-memory-dos-cve-2026-34e4e5c8eb7795be 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-leaks-cookie-and-proxy-authorization-headers-on-cross-origin-redirect-cve-2026-34518-950c039fedebbb1f 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-has-http-response-splitting-via-r-in-reason-phrase-cve-2026-34519-a726cb9562924eb9 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttps-c-parser-llhttp-accepts-null-bytes-and-control-characters-in-response-header-values-25ff542429f44535 2026-10-29T21:31:24.000Z weekly 0.9 https://radar.offseq.com/threat/ansible-aiohttp-accepts-duplicate-host-headers-cve-2026-34525-6ca97d3b07e559eb 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-is-vulnerable-to-deserialization-of-untrusted-data-cve-2026-34993-590c38fd4f9078f7 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-aiohttp-is-vulnerable-to-cross-origin-redirect-with-per-request-cookies-cve-2026-47265-90e6b7e8f3831064 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-crlf-injection-in-multipart-headers-cve-2026-50269-7dd86f5344e3bfde 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-http1-pipelined-requests-queue-without-limit-cve-2026-54273-692f12cd8061b068 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-incomplete-websocket-frame-payloads-bypass-memory-limits-cve-2026-54274-30a92d11b87810b7 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-tls-server-hostname-override-is-ignored-when-reusing-https-connections-cve-2026-54275-919280f23fe1357c 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-digestauthmiddleware-applies-credentials-to-cross-origin-redirect-challenges-cve-2026-54276-5968a34ac0dce4eb 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-c-http-parser-bypasses-maxlinesize-for-fragmented-lines-cve-2026-54277-566d7cae1377ddca 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-unread-compressed-request-bodies-bypass-clientmaxsize-during-cleanup-cve-2026-54278-111b431e4fff66b7 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-host-only-cookies-become-domain-cookies-after-cookiejar-persistence-cve-2026-54279-5629eda873bb0662 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-payload-response-resources-are-not-closed-after-mid-body-disconnect-cve-2026-54280-32f856257e44879a 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-websocket-client-accepts-compressed-frames-without-negotiated-permessage-deflate-cve-2026-59881-237f4ea7e24bcebc 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-http-request-smuggling-via-websocket-upgrade-cve-2026-69243-9d90c7485545cb6b 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-out-of-bounds-heap-read-in-c-http-response-parser-error-path-malformed-chunked-response-cve-04fbd40cf4e51044 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-multiple-instances-of-excessive-or-unbounded-memorycpu-use-d87917d0ceea8da1 2026-10-29T21:31:24.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-aiohttp-has-vulnerable-dependency-that-is-vulnerable-to-request-smuggling-4d9ab72da14c4fe5 2026-10-29T21:31:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-a07221bb2e7081e0 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-d137faf1db137b4f 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-081cb9ece1cce07d 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-6cffdc78631e7246 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-1c41ac0a9156ca92 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-04f67c4b097deb90 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-bf3e8659d40713b7 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-e55937fc08ec07f7 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-0288a0ddc1106abf 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-447b9fc4e138c3a5 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-ce5b72783094b9d6 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-ad883dc66c135191 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-0f525ddce05a571c 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-7300ae717b1c4735 2026-10-29T21:31:26.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-8c36318b74f87f7c 2026-10-29T21:31:26.000Z weekly 0.7 https://radar.offseq.com/threat/aws-cdk-cli-prints-aws-credentials-retrieved-by-custom-credential-plugins-cve-2025-2598-f3df989f83c5d7a2 2026-10-29T21:31:34.000Z weekly 0.7 https://radar.offseq.com/threat/cloudflare-wrangler-wrangler-affected-by-os-command-injection-in-wrangler-pages-deploy-cve-2026-0933-8fd87dae8c0a7d33 2026-10-29T21:31:36.000Z weekly 0.8 https://radar.offseq.com/threat/bazarr-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-arbitrary-1ad3eae3b6a9ea99 2026-10-29T21:31:41.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-122d53f5952837f7 2026-10-29T21:31:41.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-d70ec1f8841aab31 2026-10-29T21:31:41.000Z weekly 0.7 https://radar.offseq.com/threat/bilix-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-39b1475bc629b3e1 2026-10-29T21:31:41.000Z weekly 0.9 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-313b6dfb92ff2a09 2026-10-29T21:32:00.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-eefef0fd28e1f840 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/cycode-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-5e8199e488c2b26c 2026-10-29T21:32:08.000Z weekly 0.8 https://radar.offseq.com/threat/cycode-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-60b2e7928e2bae81 2026-10-29T21:32:08.000Z weekly 0.8 https://radar.offseq.com/threat/cycode-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-f18ea54f20c0dbce 2026-10-29T21:32:08.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-6c414598e7c064f8 2026-10-29T21:32:08.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-d34bacd98e70c50c 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-7f151e71738c92c4 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-126dc2f3cb6342c1 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-6872314aca186694 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-2ca5ad98954af582 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-d8ea2f02514379da 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-c330e9307a5c86d1 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-71b605038824d9d6 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-ffcf1e57540e8c1f 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-101f042182d6566b 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-5f36bd3712329a58 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-32f1b8db6b0833ae 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-07895578cb639ae9 2026-10-29T21:32:08.000Z weekly 0.7 https://radar.offseq.com/threat/check-jsonschema-default-caching-for-remote-schemas-allows-for-cache-confusion-cve-2024-53848-9e530dd4ddfbc1b2 2026-10-29T21:32:13.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-df0c033e7dc6ce46 2026-10-29T21:32:34.000Z weekly 0.7 https://radar.offseq.com/threat/cf2tf-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-48718f82f29477ad 2026-10-29T21:32:34.000Z weekly 0.8 https://radar.offseq.com/threat/cf2tf-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-c54f196380bd23d2 2026-10-29T21:32:34.000Z weekly 0.8 https://radar.offseq.com/threat/cf2tf-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-b4876babeb2e37a5 2026-10-29T21:32:34.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-4cbfc6b4ba8e7f51 2026-10-29T21:32:34.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-ec8db038591b94eb 2026-10-29T21:32:34.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-remote-code-execution-via-arbitrary-file-write-cve-2024-27081-9a94c73d639cd7c8 2026-10-29T21:32:37.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-vulnerable-to-stored-cross-site-scripting-in-edit-configuration-file-api-cve-2024-27287-f1025d9d2fc18ec8 2026-10-29T21:32:37.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-vulnerable-to-authentication-bypass-via-cross-site-request-forgery-cve-2024-29019-dfeae64a97d134f7 2026-10-29T21:32:37.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-esp-idf-webserver-basic-auth-bypass-using-empty-or-incomplete-authorization-header-cve-2025-5d90d96703c511b4 2026-10-29T21:32:37.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-vulnerable-to-denial-of-service-via-out-of-bounds-check-bypass-in-the-api-component-cve-2026-ff191596d283e65d 2026-10-29T21:32:37.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-a-stored-cross-site-scripting-xss-vulnerability-exists-in-netbox-410-within-the-configuration-3a878c22300b7eee 2026-10-29T21:32:40.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-5affebd4e59d763a 2026-10-29T21:32:40.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-arbitrary-58682f94468b3160 2026-10-29T21:32:40.000Z weekly 0.8 https://radar.offseq.com/threat/multidict-reference-leak-in-cimultidictmultidict-items-view-union-and-subtraction-cve-2026-104874-6a1992036472d100 2026-10-29T21:32:40.000Z weekly 0.7 https://radar.offseq.com/threat/ansible-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-fa6eee08e94d0a65 2026-10-29T21:32:40.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-bb414aa2fac6c198 2026-10-29T21:32:40.000Z weekly 0.8 https://radar.offseq.com/threat/ansible-paramiko-rsakeypy-allows-the-sha-1-algorithm-cve-2026-44405-f11035dfae0ce3ed 2026-10-29T21:32:40.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-e84bd2e088db721e 2026-10-29T21:32:40.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-14cf01fe95c130d8 2026-10-29T21:32:40.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-abd3ecc3cd54ed4b 2026-10-29T21:33:02.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-969bc847f07f1e08 2026-10-29T21:34:10.000Z weekly 0.9 https://radar.offseq.com/threat/esphome-starlette-has-possible-denial-of-service-vector-when-parsing-large-files-in-multipart-forms-4af0e4abfad4204e 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-starlette-vulnerable-to-on2-dos-via-range-header-merging-in-starletteresponsesfileresponse-9dd34cb229868875 2026-10-29T21:34:10.000Z weekly 0.8 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-0b40c1c797dd0916 2026-10-29T21:34:10.000Z weekly 0.9 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-88bd7687e04cc9fe 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-b3fec31d4842c99f 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-c0998c2ca0ec1c39 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-50142c35f7986ec9 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-116a7a63db13338b 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-d0ee175d6fe0b3f4 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-01009548b6f66c60 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-2256f4366584535b 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-76f5d1168e22cf5d 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-973938e16d20d362 2026-10-29T21:34:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-df94a77c77db57b1 2026-10-29T21:34:10.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-cbor2-has-a-denial-of-service-via-uncontrolled-recursion-in-cbor2loads-cve-2026-26209-2964c1cee5a66287 2026-10-29T21:34:10.000Z weekly 0.8 https://radar.offseq.com/threat/esphome-starlette-denial-of-service-dos-via-multipartform-data-cve-2024-47874-021d9fb92c50aecb 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-zeroconf-has-unbounded-recursion-in-dns-compression-pointer-decoder-that-allows-lan-local-89b957fec165c0dd 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/zeroconf-unbounded-exception-dedup-state-retains-packet-buffers-via-traceback-frame-locals-enabling-8b56548241f9e1d4 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-zeroconf-has-unbounded-dns-record-cache-that-allows-lan-local-memory-exhaustion-via-multicast-c3398db18881c245 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/python-zeroconf-unbounded-tc-deferred-queue-allows-lan-local-memory-exhaustion-via-spoofed-source-flood-c98d85195af5882f 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/zeroconf-unvalidated-rdlength-in-record-payload-readers-allows-lan-local-cache-corruption-via-crafted-6742597bd6bcc401 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/esphome-starlette-has-missing-host-header-validation-that-poisons-requesturlpath-bypassing-path-based-25c19434c4ca3f0b 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-arbitrary-http-method-dispatched-to-httpendpoint-attributes-via-getattr-cve-2026-48817-e5526c14642b0b91 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-unvalidated-request-path-concatenated-into-authority-poisons-requesturlhostname-cve-2026-79a32fb8dc81c800 2026-10-29T21:34:13.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-requestform-limits-silently-ignored-for-applicationx-www-form-urlencoded-enable-dos-cve-2026-9e6ab99cdc03a250 2026-10-29T21:34:13.000Z weekly 0.8 https://radar.offseq.com/threat/chatblade-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-29526c94e25003e1 2026-10-29T21:34:18.000Z weekly 0.9 https://radar.offseq.com/threat/checkdmarc-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-fe99977e1410fba1 2026-10-29T21:35:25.000Z weekly 0.8 https://radar.offseq.com/threat/http-prompt-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-87b62671c6581068 2026-10-29T21:35:27.000Z weekly 0.8 https://radar.offseq.com/threat/http-prompt-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-1c852bcb6a21e35d 2026-10-29T21:35:27.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-3cd016cbf9a63e27 2026-10-29T21:35:27.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-198ec2b4359ffafd 2026-10-29T21:35:27.000Z weekly 0.7 https://radar.offseq.com/threat/dnsrobocert-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-bd091f77fa1611a8 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-ee1c99fcfb92df8b 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/dnsrobocert-aiohttp-server-lacks-an-initial-requestheader-timeout-cve-2026-111064-0b0b02d59c8f5f85 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-connector-pool-exhaustion-via-max-age-overflow-cve-2026-111065-77cfb33e45a76441 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-file-descriptor-exhaustion-in-multipart-requests-cve-2026-111066-85431d1a8c9c7541 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-absolute-form-request-targets-can-spoof-requestscheme-cve-2026-111748-6f4e97e87ce18294 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-cookie-from-subdomain-can-remove-host-only-scope-from-existing-cookies-cve-2026-111749-026523418679c1e8 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-pure-python-parser-request-smuggling-cve-2026-111750-5645c001e2b2eeed 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-1fe457d4575de91d 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-5206cff737a3db80 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-de8495ead1c0f121 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-0bcc6caef8159331 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-85b5025c7c169a91 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-e5d48956ed531859 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-f842cb7d99b62b74 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-2f16b593d4275d4d 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-31b1f6b604c3e1b2 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-9418c95339a82596 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-5984a19a3a99b472 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-911a38dcdaf2bf44 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-f32f1a9015370bec 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-429df22160f0c005 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-62fa97bc75fc6e41 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/dnsrobocert-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-08c812005a563266 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/dnsrobocert-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-a3ab4170bbef8b35 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/dnsrobocert-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-7cc6ef69f0941a59 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-1d8a38f45411b038 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-ea00309657454184 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-e3f9eee42056c3d6 2026-10-29T21:35:34.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-multiple-instances-of-excessive-or-unbounded-memorycpu-use-27650b2064321967 2026-10-29T21:35:34.000Z weekly 0.8 https://radar.offseq.com/threat/grayskull-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-eed75cc1929edb25 2026-10-29T21:36:13.000Z weekly 0.8 https://radar.offseq.com/threat/grayskull-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-bab9ee4db1002724 2026-10-29T21:36:13.000Z weekly 0.8 https://radar.offseq.com/threat/grayskull-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-4004e9e9c3fb5ba3 2026-10-29T21:36:13.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-2b79ea1d8ae7664e 2026-10-29T21:36:13.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-3f36c1aabadd5927 2026-10-29T21:36:13.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-cfcf6f0a83d65c7f 2026-10-29T21:36:13.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-c574b7fbf6f9cfb3 2026-10-29T21:36:13.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-18b0250f3b1b6726 2026-10-29T21:36:13.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-ae1fe6b7ba1c7456 2026-10-29T21:36:33.000Z weekly 0.7 https://radar.offseq.com/threat/cobo-cli-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-fc28034fc07ada5f 2026-10-29T21:36:33.000Z weekly 0.8 https://radar.offseq.com/threat/cobo-cli-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-d5a742876eb148fd 2026-10-29T21:36:33.000Z weekly 0.8 https://radar.offseq.com/threat/cobo-cli-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-5b0df67478867a5c 2026-10-29T21:36:33.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-920246775b7ca133 2026-10-29T21:36:33.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-6a2f289519c4dfaf 2026-10-29T21:36:33.000Z weekly 0.7 https://radar.offseq.com/threat/cobo-cli-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-a03eb2ab5eec36d8 2026-10-29T21:36:33.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-dadb7ee453ff2596 2026-10-29T21:36:57.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-untrusted-search-path-under-some-conditions-on-windows-allows-arbitrary-code-execution-cve-2024-f2d633a8719f0645 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-c326569a6b30f37a 2026-10-29T21:37:15.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-2671b9b2187662dc 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-write-and-8f08be48480d18ee 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-6f90693ab1df281f 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-05e6bb604f05a2a3 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-1f4009b97d2432ad 2026-10-29T21:37:15.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-27f097bdc925fe80 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-183ba23e20f77879 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-eb360e09dc1322c1 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-218ef0989bde0d19 2026-10-29T21:37:15.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-4a09a505a6ce81ea 2026-10-29T21:37:15.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-8dadcb20ede3f259 2026-10-29T21:37:15.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-82e0c9c344792229 2026-10-29T21:37:15.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-c9c5137da7d426ef 2026-10-29T21:37:21.000Z weekly 0.7 https://radar.offseq.com/threat/gitup-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-3a701c170ab535f6 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-9b74281e8b386843 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-c27484e26d77b40e 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-c5c9628b62b324e2 2026-10-29T21:37:21.000Z weekly 0.7 https://radar.offseq.com/threat/gitup-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-60303eff72e32acd 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-59b7acdab0c5c776 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-3673051b3aee598a 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-bdd63875ebd6cb9e 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-69f0daa01480c1e0 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-ba48eec9ca4d431f 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitup-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-e2e308a1edf4bbff 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-0fdf09410faf07ea 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-e221d8ce41400462 2026-10-29T21:37:21.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-09706aa8962b9f44 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-overwrite-via-git-diff-output-argument-injection-in-diffablediff-key-and-42da9f30ad963552 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-0df5fee1b17d9e95 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-698337ccc0f2caef 2026-10-29T21:37:21.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-99d799c62987920d 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-bd45560ab4556930 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-d5335cf161650151 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-6a1286793ea631b4 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-857bd1f9318cd913 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-e647a758a6514cfd 2026-10-29T21:37:21.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-8871433d17250c92 2026-10-29T21:37:43.000Z weekly 0.7 https://radar.offseq.com/threat/dulwich-infinite-loop-denial-of-service-dos-in-packfile-object-resolution-cve-2026-114095-110e93cf1c116dc1 2026-10-29T21:37:43.000Z weekly 0.7 https://radar.offseq.com/threat/multidict-reference-leak-in-cimultidictmultidict-items-view-union-and-subtraction-cve-2026-104874-e990804698f78e02 2026-10-29T21:37:58.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-f00d9c15eb1c4c59 2026-10-29T21:37:58.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-cli-prints-the-registry-push-token-in-langgraph-deploy-verbose-output-cve-2026-115885-3703d12ca3a94993 2026-10-29T21:38:16.000Z weekly 0.7 https://radar.offseq.com/threat/langgraph-unencoded-identifiers-in-langgraph-sdk-v3-streaming-can-redirect-authenticated-get-requests-d1d564ff38a6b7dc 2026-10-29T21:38:16.000Z weekly 0.7 https://radar.offseq.com/threat/marked-vulnerable-to-oom-denial-of-service-via-infinite-recursion-in-marked-tokenizer-cve-2026-41680-9755fb3ffaa91a7a 2026-10-29T21:38:46.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-de338408108b096d 2026-10-29T21:38:54.000Z weekly 0.7 https://radar.offseq.com/threat/internetarchive-is-vulnerable-to-directory-traversal-through-file-downloads-cve-2025-58438-126fe80c2365a14c 2026-10-29T21:39:15.000Z weekly 0.9 https://radar.offseq.com/threat/conda-lock-untrusted-search-path-under-some-conditions-on-windows-allows-arbitrary-code-execution-cve-8d5cdfc94e0ad223 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-9910c0b023917c8a 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-60ded61ade110ff7 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-aca8a4755164a66e 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-b7e2b1abeebe9f68 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/conda-lock-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-7a9e4a33a7e39de8 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-d71a4986e204faca 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-939b5a925794daa2 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-583eef6a43821577 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-370ef576b2758386 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-018c294dbe289682 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-96adac1d109ad7ac 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-52d90242e5f2696d 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-7e1afb80485b6eb4 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-d038e2fa19679a29 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-d9c313cfead05a15 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-61a6a81988898e86 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-a2a5efd33870c1ff 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-ab494e70fd8f5506 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-f3d6026b993d52bc 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-venv-configuration-readback-can-reinterpret-path-boundaries-cve-2026-113715-9bfac3495cbb8a39 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-8ad2792527916644 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-pip-seeding-with-download-omits-wheel-digest-verification-cve-2026-113717-e9ccd414b19333a0 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seed-replacement-does-not-contain-metadata-deletion-paths-cve-2026-113719-b3f2600f8a3ba78a 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seeded-files-retain-permissions-from-an-older-cache-cve-2026-113720-c664573dc78ec095 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-d5648a8097cf05d2 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-10870cd1626cb16d 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-31a07c3b3405c037 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-cve-547f6335ffe8246c 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-1858f5726011b98c 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-379864a3363eedde 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-ee69da3aacdfa047 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-e2f89382bb4d7d34 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-cfb0013ca2e1ab28 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-ba60664f07c81703 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-7089a58903b926b8 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-47b6799142083c39 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-42fd389a0512758b 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-63dfab211d11a8f8 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-249169d3bc19e6b3 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-fc39fa5a6c7d1895 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/conda-lock-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-6e1b3abd5e23cf82 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-b97eab717f28819c 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-1e745d9cb0a8f648 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-620b70dc0ecfa31f 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-a8213e29632c3433 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-c934b06a4b78690e 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-84f4493683f45677 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-124a0a7e454549c8 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-443455a59642efbb 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-overwrite-via-git-diff-output-argument-injection-in-diffablediff-key-and-874e8fddd526d2b2 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-2e0300ce521de6cb 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-8c46282fe562330e 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-33ef9d3edf07bf43 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-ec849c05d2fb557f 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-338657a6ce62b039 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-df8485daf5fa5356 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-791233772242f3c7 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-6e741a86ff981de0 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-e8d67701a2cec7cc 2026-10-29T21:39:28.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-951d6b0eda30ef70 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-137af66b1cd1b880 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-87081814b464c614 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-82af3e16b7b071d1 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-a8609d3fd620a900 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/dulwich-symlink-directory-traversal-in-filter-branch-indexfilter-via-cross-commit-state-persistence-ce150c24864d43a4 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/dulwich-symlink-write-through-in-checkoutpaths-via-raw-osopen-bypasses-all-symlink-protections-cve-8ecc295693088762 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/dulwich-symlink-directory-traversal-in-stash-pop-allows-arbitrary-file-write-via-intermediate-09e1a59c9237f61f 2026-10-29T21:39:28.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-61a046422bf824b3 2026-10-29T21:39:28.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-221017d27007e97d 2026-10-29T21:40:00.000Z weekly 0.7 https://radar.offseq.com/threat/opentelemetry-python-unbounded-tracestate-parsing-in-opentelemetry-api-cve-2026-114603-69514fa3c98a9387 2026-10-29T21:40:54.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-185c356ad87eaa07 2026-10-29T21:40:54.000Z weekly 0.8 https://radar.offseq.com/threat/pyjwt-hs256384512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwkpyjwkclient-enabling-token-forgery-5ce819ada8f52088 2026-10-29T21:40:54.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-4fb292765ad820a2 2026-10-29T21:40:54.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-tornado-vulnerable-to-excessive-logging-caused-by-malformed-multipart-form-data-cve-2025-ef6af21f9a3c01f6 2026-10-29T21:41:13.000Z weekly 0.8 https://radar.offseq.com/threat/nvchecker-tornado-has-incomplete-validation-of-cookie-attributes-cve-2026-35536-218df59881f8d172 2026-10-29T21:41:13.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-authorization-header-forwarded-across-cross-origin-redirects-in-simpleasynchttpclient-cve-2026-adfddf64d6482058 2026-10-29T21:41:13.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-unbounded-query-string-argument-count-allows-event-loop-stalling-dos-cve-2026-103261-11fd048b57cb6ba2 2026-10-29T21:41:13.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-inconsistent-interpretation-of-http-requests-http-requestresponse-smuggling-in-tornado-cve-711a9431cfc0d177 2026-10-29T21:41:13.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-multipart-split-creates-huge-temp-list-before-maxparts-check-memory-amplification-dos-18e8794eb7059197 2026-10-29T21:41:13.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-tornado-has-an-http-cookie-parsing-dos-vulnerability-cve-2024-52804-bfffb884b6dcfc8f 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/nvchecker-tornado-vulnerable-to-header-injection-and-xss-via-reason-argument-cve-2025-67724-3fa4780b946236aa 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-dos-via-repeated-header-coalescing-cve-2025-67725-c364990b0580fcf8 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-quadratic-dos-via-crafted-multipart-parameters-cve-2025-67726-d6edde51d32c3d56 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-event-loop-blocking-and-excess-memory-use-from-chunked-bodies-with-many-small-chunks-cve-2026-ebb2b407ca225c11 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-cpu-usage-when-parsing-http-headers-with-line-folding-cve-2026-116577-b443e50f6b6128e5 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-open-redirect-in-redirecthandler-via-protocol-relative-urls-cve-2026-116578-6f28348279ef272d 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-tornado-is-vulnerable-to-dos-due-to-too-many-multipart-parts-cve-2026-31958-3ce773c8fc555381 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/nvchecker-tornado-has-out-of-bounds-memory-access-via-c-extension-cve-2026-49854-2bc1c4a2de8eb6e3 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-tornado-asynchttpclient-accumulates-decompressed-chunks-without-size-limit-gzip-bomb-cve-f20916b0a5c6739a 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-urlencoded-body-parsing-omits-maxnumfields-so-one-request-can-stall-the-event-loop-cve-2026-154df145707b1fc9 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-staticfilehandler-follows-symlinks-outside-static-root-path-traversal-cve-2026-103263-a4baaf09271d17db 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-curlasynchttpclient-enforces-no-response-size-limit-decompression-bomb-drives-unbounded-memory-764e97086afc3ee2 2026-10-29T21:41:23.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-curlasynchttpclient-leaks-per-request-credentials-on-handle-reuse-cve-2026-91992-8b8db299fbb4ec2e 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/nvchecker-tornado-has-a-crlf-injection-in-curlasynchttpclient-headers-cve-2024-58384-03171d9f7a152e24 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-incomplete-fix-for-cve-2026-35536-cookie-attribute-injection-re-opened-via-the-legacy-case-8ae579c67e10e9bd 2026-10-29T21:41:23.000Z weekly 0.7 https://radar.offseq.com/threat/pi-agent-pi-loads-project-local-extensions-without-approval-cve-2026-54325-e7f8b0d54a6bcf5e 2026-10-29T21:41:30.000Z weekly 0.7 https://radar.offseq.com/threat/pi-agent-potential-xss-in-html-session-exports-via-markdown-url-sanitization-bypass-cve-2026-54326-4f72d5f571e14ceb 2026-10-29T21:41:30.000Z weekly 0.7 https://radar.offseq.com/threat/pi-agent-race-condition-in-pi-authjson-writes-could-expose-stored-credentials-cve-2026-54327-efe988918a989f13 2026-10-29T21:41:30.000Z weekly 0.7 https://radar.offseq.com/threat/pi-agent-predictable-temporary-extension-install-paths-allow-local-privilege-escalation-on-shared-10439829123c4f47 2026-10-29T21:41:30.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-jwsjwt-accepts-unknown-crit-headers-rfc-violation-possible-authz-bypass-cve-2025-59420-296d027093e6f7c9 2026-10-29T21:42:00.000Z weekly 0.8 https://radar.offseq.com/threat/safety-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-cve-68fa209fb1f8c2dc 2026-10-29T21:42:00.000Z weekly 0.8 https://radar.offseq.com/threat/safety-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-cve-2026-716cb483e0fcc734 2026-10-29T21:42:00.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-48c1992b7e347d4f 2026-10-29T21:42:00.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-9536cbb9fee58442 2026-10-29T21:42:00.000Z weekly 0.7 https://radar.offseq.com/threat/safety-authlib-vulnerable-to-jwe-rsa15-bleichenbacher-padding-oracle-cve-2026-28490-603ca782354e6e49 2026-10-29T21:42:00.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-setting-alg-none-and-a-blank-signature-appears-to-bypass-signature-verification-cve-2026-28802-399a0322ec82e25d 2026-10-29T21:42:00.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-1eb0e09e3fab4aa6 2026-10-29T21:42:00.000Z weekly 0.9 https://radar.offseq.com/threat/safety-nltk-has-a-zip-slip-vulnerability-cve-2025-14009-0cf03295cfe3fce2 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/safety-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-3b0df83cded9fc75 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/safety-authlib-is-vulnerable-to-denial-of-service-via-oversized-jose-segments-cve-2025-61920-9c2e3ce603df2077 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-jwe-zipdef-decompression-bomb-enables-dos-cve-2025-62706-3a143aa9569af6e0 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-authlib-has-1-click-account-takeover-vulnerability-cve-2025-68158-a513e2299c65ed48 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-nltk-vulnerable-to-eval-injection-via-collocations-cli-arguments-cve-2025-71408-1abd78d3d259cd8e 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-has-arbitrary-file-read-via-absolute-path-input-in-nltkutilfilestring-cve-2026-0846-fd8f14cc36e98698 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-has-a-path-traversal-issue-cve-2026-0847-a2f3aa7abd4eb8d8 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-versions-392-are-vulnerable-to-arbitrary-code-execution-due-to-improper-input-cve-2026-0848-e24809f54ff3067c 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-wekaclassifier-passes-an-unvalidated-caller-controlled-model-path-to-the-weka-jvm-bypassing-c5e24b5d9b5e33cc 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-6386dcfbae5c8144 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-0c683179db40c374 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-1f809a2df4146686 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-742f0334728565d8 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-70ee97b732937b7b 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-c619395833d39bcb 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-6bf3562ac2ff08b7 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-427dedf62f923e92 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-13d9aaccc8db4df9 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-b29095a57a8d01ab 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-4216aa7873823b1b 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-65f3e0a2715f07c0 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-58d575bb7c00f6bb 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-redos-in-nltk-reviewscorpusreader-features-regex-cve-2026-12061-afa88bb35b0dd497 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-path-traversal-in-nkjpcorpusreader-leads-to-arbitrary-file-read-d3baa2fb29f664ae 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-has-path-traversal-in-framenetcorpusreaderframe-that-allows-20471ca620000292 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-dns-rebinding-ssrf-filter-bypass-in-nltkpathsecurlopen-5a3d1c3e7a33cc7f 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-stanford-wrapper-classes-execute-untrusted-jar-files-without-verification-cve-2026-12252-04f497101eb63c4a 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-downloader-allows-cross-package-resource-and-model-poisoning-cve-2026-12261-86e62798b4d4af5b 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-nltk-network-url-validation-permits-ssrf-to-rfc-6598-shared-address-space-hosts-cve-2026-12372-f32b720a4f16d3ca 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-uncontrolled-resource-consumption-in-recursivedescentparser-via-ambiguous-or-left-recursive-98e1f18871231de1 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-5c3ac89503a4c40f 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-fail-open-cryptographic-verification-in-oidc-hash-binding-cve-2026-28498-e4f6db406a1ab766 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-nltk-cve-eb64cc2f3d7c9dd0 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-unauthenticated-remote-shutdown-in-nltkappwordnetapp-cve-2026-33231-a0e5aa3a7598572e 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-has-a-downloader-path-traversal-vulnerability-afo-arbitrary-file-overwrite-cve-2026-33236-1c421afa708ef000 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-cross-site-request-forging-when-using-cache-cve-2026-41425-0090dc1274a6f184 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-authlib-oauth-20-has-open-redirect-in-authorization-api-that-allows-attacker-controlled-54326fc421c6b3f0 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-authlib-oidc-implicithybrid-authorization-vulnerable-to-open-redirect-cve-2026-44681-550487b816e10efd 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-b64false-rfc7797-jws-payloads-bypass-jwsregistry-payload-size-limits-during-deserialization-b68a5caa6bd5a23f 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-hs256hs384hs512-verify-accepts-emptynil-hmac-key-cross-language-sibling-of-cve-2026-45363-cve-f9473e6b7af71958 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-url-encoded-path-traversal-in-nltkdataload-allows-arbitrary-local-b7e6fb611c77b3c0 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-symlink-based-arbitrary-file-read-in-ipipancorpusreader-bypasses-nltkpathsec-entirely-cve-2026-ef79d3dd23b27551 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-symlink-based-sandbox-bypass-in-framenetcorpusreader-bypasses-the-fix-for-cve-2026-54292-cve-2026-c32cca6d369214a5 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-stable-framenet-and-nkjp-readers-parse-outside-root-xml-cve-2026-62385-3db1231e917acf55 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-default-enforcefalse-disables-all-pathsec-security-controls-cve-2026-62388-7a7fa9d22f109966 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-ssrf-fail-open-in-validatenetworkurl-via-dns-resolution-failure-cve-2026-63311-5d194de4a7108bcb 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-streambackedcorpusview-bypasses-pathsecenforce-arbitrary-local-file-read-cve-2026-63312-eac9e1fe01e7c82c 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-filesystempathpointeropen-sandbox-check-is-dead-code-arbitrary-file-read-via-file-protocol-c6b2192ef022d0c9 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-natural-language-toolkit-nltk-has-unbounded-recursion-in-jsontaggeddecoderdecodeobj-may-cause-a362b45b5ad2f3c9 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-symlink-escape-in-corpusreader-allows-arbitrary-local-file-read-outside-the-corpus-root-cve-2026-88ee10b5bd2e182c 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-nltk-allowlistunpickler-dotted-name-validation-bypass-allows-remote-code-execution-cve-2026-12c175d59f61e4ee 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/safety-nltk-crubadancorpusreader-path-traversal-allows-arbitrary-file-disclosure-cve-2026-71514-3b0452accf689857 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/safety-nltk-tweettokenizer-vulnerable-to-denial-of-service-through-catastrophic-regex-backtracking-cve-c8b4dee8259d313c 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-uncontrolled-search-path-when-invoking-the-graphviz-dot-binary-cve-2026-78680-9b37ed08273fb730 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-entity-expansion-dos-billion-laughs-via-remaining-raw-elementtree-parses-cve-2026-78681-27b8ddb10ef5a261 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-pathsec-ssrf-protection-can-be-bypassed-when-a-proxy-is-configured-cve-2026-78682-e0bd26f9ea475e2d 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-unsafe-pickle-deserialization-in-transitionparser-allows-remote-code-execution-cve-2026-78683-eac4ef692c4f6f6c 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-allowlisted-pickle-loaders-still-permit-code-execution-in-current-source-cve-2026-79657-9272da6cc7ac3944 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-corpus-reader-sandbox-bypass-cve-2026-79674-72f773b01a94992f 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-jvm-argument-injection-bypass-via-per-call-options-in-the-nltk-stanford-wrappers-incomplete-fix-of-d2ad2502246f3e47 2026-10-29T21:42:01.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-corpus-readers-follow-symlinks-outside-trusted-roots-despite-pathsec-enforcement-cve-2026-79676-db7ba9bdc27c939b 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-redos-in-nltktexttextfindall-via-unvalidated-user-supplied-regular-expressions-cve-2026-80205-8ff1f840d7b7046c 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-redos-in-nltktgrep-via-unvalidated-user-supplied-regular-expressions-cve-2026-80206-0822a091449d2049 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-quadratic-time-dos-in-porterstemmer-via-long-runs-of-y-cve-2026-81722-c800cdce183523a8 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-quadratic-cpu-exhaustion-in-xmlcorpusviewreadxmlfragment-cve-2026-81723-f87d10044fba0074 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-uncontrolled-recursion-in-nltkfeatstructfeatstructreader-causes-unhandled-recursionerror-dos-via-391d4b8002466c51 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-pl196xcorpusreader-has-quadratic-redos-on-malformed-tei-blocks-cve-2026-81725-6ec45087595673be 2026-10-29T21:42:01.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-downloaderdownload-follows-hardlinks-and-overwrites-outside-root-files-cve-2026-81727-50e0e1f79ac91a3e 2026-10-29T21:42:01.000Z weekly 0.8 https://radar.offseq.com/threat/dstack-python-multipart-vulnerable-to-content-type-header-redos-cve-2024-24762-604d9103dfd3763e 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/dstack-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-e9ce2f140e9f2e6e 2026-10-29T21:42:36.000Z weekly 0.9 https://radar.offseq.com/threat/dstack-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-cve-3fbb476adb180266 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-91bd7ad5330da9f3 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-f36953a70e54114a 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/dstack-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-8be0f8fcb5a9dd7a 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/dstack-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-2945c4f597d4f662 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-56231c3c2a46b8f3 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-9fa76f3b95333d5e 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-7f5c8479519ba141 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-ca14eb7335f22720 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-de605e71fe182b8e 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-ed0f89379123767e 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-b275cf1965065d73 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-9b0be377b4299858 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-ae27af74797aeaee 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-bee19eff4fbefe5a 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-07d90f1bb6dbb671 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-9b6ac10c73345492 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-290e61143179e7a4 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-cd7a7d53a801e21e 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-c3d0d13f9150bd58 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-d67cf00fae2b9a06 2026-10-29T21:42:36.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-56b328ca85bddfe1 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-40e1a0417db988ad 2026-10-29T21:42:36.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-sentrys-python-sdk-unintentionally-exposes-environment-variables-to-subprocesses-cve-2024-40647-9f900ef2a8567f6f 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-starlette-denial-of-service-dos-via-multipartform-data-cve-2024-47874-0d21c7f4035f1c3a 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-starlette-has-possible-denial-of-service-vector-when-parsing-large-files-in-multipart-forms-cve-d8206f216a53494c 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-starlette-vulnerable-to-on2-dos-via-range-header-merging-in-starletteresponsesfileresponse-7504f1be4ae9ece6 2026-10-29T21:42:37.000Z weekly 0.8 https://radar.offseq.com/threat/dstack-paramiko-rsakeypy-allows-the-sha-1-algorithm-cve-2026-44405-4df3914d4c5b9c0c 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/dstack-starlette-has-missing-host-header-validation-that-poisons-requesturlpath-bypassing-path-based-c5509e581a98fa38 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-arbitrary-http-method-dispatched-to-httpendpoint-attributes-via-getattr-cve-2026-48817-7d18ef430a26343c 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-unvalidated-request-path-concatenated-into-authority-poisons-requesturlhostname-cve-2026-2758a8b68a170fe7 2026-10-29T21:42:37.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-requestform-limits-silently-ignored-for-applicationx-www-form-urlencoded-enable-dos-cve-2026-09cc40c36fb0cddc 2026-10-29T21:42:37.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-fe34320301121591 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-87dde7c370ae2192 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-be7f40f99db3731c 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-f96a6af8dd2e5619 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-aa4ab6f6d561f448 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-d9479d7db19bf020 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-f45aab211962f1ca 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-a5dfe105e3825dfb 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-64a253c64b813b56 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-c5074bc4d070f60f 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-f2fe5e7e1370429d 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-75163a3f448d2f2c 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-7a5269be03cb47f8 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-d2172397bef919ff 2026-10-29T21:42:43.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-d6a4c2b506827339 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/oterm-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-94703312ed292cbf 2026-10-29T21:42:43.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-efc6fb2fdedd1587 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/oterm-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-cve-e01c609b4fdb94c2 2026-10-29T21:42:43.000Z weekly 0.8 https://radar.offseq.com/threat/oterm-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-cve-2026-b4114ca91e523935 2026-10-29T21:42:43.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-10afe82bb0ddf627 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-55df9f372d385023 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-c006841075731608 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-d275b0e8bb829fce 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-d617aa789d56653d 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-92cc11f658c172d1 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-c6274f1a009db67c 2026-10-29T21:42:43.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-512ff6a73935f8a6 2026-10-29T21:42:43.000Z weekly 0.9 https://radar.offseq.com/threat/oterm-fastmcp-mcp-client-wrappers-construct-m2m-oauth-providers-without-issuer-binding-client-secret-d55b13370c1946c1 2026-10-29T21:42:43.000Z weekly 0.7 https://radar.offseq.com/threat/mac-cleanup-py-pygments-has-regular-expression-denial-of-service-redos-due-to-inefficient-regex-for-890ed9faa77dab03 2026-10-29T21:42:46.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-fedd6e03d684ec2d 2026-10-29T21:42:56.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-f07894cb92fb03af 2026-10-29T21:42:56.000Z weekly 0.7 https://radar.offseq.com/threat/pdm-project-local-state-and-config-writes-follow-symlinks-cve-2026-47763-378bca26d4af7a79 2026-10-29T21:42:58.000Z weekly 0.7 https://radar.offseq.com/threat/pdm-path-traversal-in-wheel-installation-via-overridden-writetofs-cve-2026-47764-34e7094cb3afece5 2026-10-29T21:42:58.000Z weekly 0.8 https://radar.offseq.com/threat/pdm-project-controlled-pdm-plugins-content-executes-before-cli-parsing-cve-2026-47781-e3dc842e67c79ada 2026-10-29T21:42:58.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-4d8c6f566f7ff1ce 2026-10-29T21:43:07.000Z weekly 0.7 https://radar.offseq.com/threat/standardebooks-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-f185de89452004be 2026-10-29T21:43:07.000Z weekly 0.8 https://radar.offseq.com/threat/standardebooks-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-33e027cd4d719432 2026-10-29T21:43:07.000Z weekly 0.8 https://radar.offseq.com/threat/standardebooks-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-4315ae8b53121d09 2026-10-29T21:43:07.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-e1b8cac1c7602bc9 2026-10-29T21:43:07.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-bdb39e4b7ccf6dd5 2026-10-29T21:43:07.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-34fe9e22121ef02d 2026-10-29T21:43:07.000Z weekly 0.7 https://radar.offseq.com/threat/mk-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-17f62cc960347326 2026-10-29T21:43:10.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-a797239651418f2e 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/mk-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-write-and-ef2650521a15943c 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-91ed3053f1584187 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-1120ba00a2cca607 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-7dcc590f3c1dbcb9 2026-10-29T21:43:10.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-1991bd9f23f6c1d3 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-0ce4c50e10be42fd 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-9153abf6b40739d3 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-7defb5e3774ea865 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-c35bb3a380a358b4 2026-10-29T21:43:10.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-39ed24392129724f 2026-10-29T21:43:10.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-e07a2161558b787c 2026-10-29T21:43:10.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-bb3760febcc9a7ad 2026-10-29T21:43:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-b15911e7162570a3 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/mk-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-b2472caeb5ff5bb2 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/mk-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-336ef28511a906b6 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/mk-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-command-3e98395fd6216c20 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-7ee55a7abfb99ebf 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/mk-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-fceb6bcc0249f0b9 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/mk-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-534a24c038e34a11 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-57fb12b2edc9a39b 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-184b6de8a6d57772 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-66bb0997f24a1496 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-89e4971cdc52fab3 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-2541cb104ee3b0b6 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/mk-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-b4c75bc1aa598be5 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-b374f4e1c44d1ebd 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-90655d95d7f6aa63 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-3595806231fac809 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-overwrite-via-git-diff-output-argument-injection-in-diffablediff-key-and-9116f43a35d29dd7 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-ed528608d7a7a147 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-abbd971424528e8e 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-37e9aff74b1aac61 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-bbd7a6a9f6ed3958 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-654d62e983598710 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-c50526ab89a0e6c2 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-07eda25aa5160767 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-62e7247147a12785 2026-10-29T21:43:12.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-4a83e616217d2725 2026-10-29T21:43:12.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-95017a39b0c46811 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-5f6265fc16744d41 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-d92fac4ba34ace09 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-50f4af70a5739dee 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-5790ad1914bc553f 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-4ca377e2f60eae0a 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-3d38977cb6a3f8ee 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-10c6f76a1643e3dc 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-7899409a824bd0bf 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-f2c51f50e2f5058e 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-a6df0ba3b241d4c6 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seed-replacement-does-not-contain-metadata-deletion-paths-cve-2026-113719-9fc57cb71dfcffcf 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seeded-files-retain-permissions-from-an-older-cache-cve-2026-113720-37fa01cefc7b7a5e 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-e754f7033dd10d52 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-229133246b899c6f 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-fa3c68c200a3b970 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-e703c68539354e0d 2026-10-29T21:44:05.000Z weekly 0.7 https://radar.offseq.com/threat/pdm-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-cve-2026-bbd115b97707dfff 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/pdm-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-2026-113726-1a958c263056a49b 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/pdm-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-cve-b7c3f13012cf222f 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/pdm-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-2026-113776-d55c6f47bb0ad3c7 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-2756bbd754c40aa6 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-aa18901b3954e0a2 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-for-python-out-of-bounds-read-crash-on-unpacker-reuse-after-a-caught-error-cve-2026-57585-d4db5baa6e0c3a3c 2026-10-29T21:44:05.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-tornado-has-an-http-cookie-parsing-dos-vulnerability-cve-2024-52804-6bb29201b23c4511 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-89f5e37421425483 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-4bccfa399e258e3d 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-tornado-vulnerable-to-excessive-logging-caused-by-malformed-multipart-form-data-cve-2025-20393786d6bc7304 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-tornado-vulnerable-to-header-injection-and-xss-via-reason-argument-cve-2025-67724-bfd2216dc270651c 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-dos-via-repeated-header-coalescing-cve-2025-67725-499de587ad29cafa 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-quadratic-dos-via-crafted-multipart-parameters-cve-2025-67726-9f357f198f526c68 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-3cf3bdbda70dd917 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-58663330c23613f3 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-6db68beae756fd75 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-f2eac6841168321e 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-8e51aa1110feff65 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-4d915bbd18b54770 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-325105f886974256 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-1d8926ae752fe135 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-c741176b6eafec36 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-fd9dd734b33991fd 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-a74857557a61ca22 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-d7f3e6b955e83efa 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-4e1a4a1cfbb0a034 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-becede2aa935bf01 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-downloaded-wheel-selection-and-caching-precede-verification-cve-2026-113714-29140423185b826d 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-venv-configuration-readback-can-reinterpret-path-boundaries-cve-2026-113715-04252e379b2a9755 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-0b87afa992e50347 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-pip-seeding-with-download-omits-wheel-digest-verification-cve-2026-113717-425bde3452167eab 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-xonsh-activation-literals-depend-on-the-script-decoding-codec-cve-2026-113718-64a198191ede4402 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-seed-replacement-does-not-contain-metadata-deletion-paths-cve-2026-113719-87987842d92d05ea 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seeded-files-retain-permissions-from-an-older-cache-cve-2026-113720-86a3f7a4ec40529e 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-a27d88a4bd04a5dc 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-f5a3b0e25f5fc936 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-1b0776eb51df18e6 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-b90fbc280b592e1c 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-a000b80c1eb80e33 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-5fac36f2aecf6faa 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-event-loop-blocking-and-excess-memory-use-from-chunked-bodies-with-many-small-chunks-cve-2026-2a988dd7e3ac7665 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-cpu-usage-when-parsing-http-headers-with-line-folding-cve-2026-116577-e25b76dbe0004c2b 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-open-redirect-in-redirecthandler-via-protocol-relative-urls-cve-2026-116578-8f0e2ca20808aa98 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/sickchill-tornado-is-vulnerable-to-dos-due-to-too-many-multipart-parts-cve-2026-31958-dcc717ec9d3a989c 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-tornado-has-incomplete-validation-of-cookie-attributes-cve-2026-35536-9d9d6987f3c8bd08 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/sickchill-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-17884ed1365d81d8 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-ff4de23923d8e4f6 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-authorization-header-forwarded-across-cross-origin-redirects-in-simpleasynchttpclient-cve-2026-69512fa92f125e18 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/sickchill-tornado-has-out-of-bounds-memory-access-via-c-extension-cve-2026-49854-74abd94f88602819 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/sickchill-tornado-asynchttpclient-accumulates-decompressed-chunks-without-size-limit-gzip-bomb-cve-4b362806af24569c 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-2b8ce730b057ed9c 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-urlencoded-body-parsing-omits-maxnumfields-so-one-request-can-stall-the-event-loop-cve-2026-fd5ff22647165c82 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-14fad6251e261cc6 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-a8aa7953204d45fb 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-unbounded-query-string-argument-count-allows-event-loop-stalling-dos-cve-2026-103261-71fec25779be406e 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/sickchill-inconsistent-interpretation-of-http-requests-http-requestresponse-smuggling-in-tornado-cve-a75939e4c9765946 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-multipart-split-creates-huge-temp-list-before-maxparts-check-memory-amplification-dos-3add37a19337d669 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-staticfilehandler-follows-symlinks-outside-static-root-path-traversal-cve-2026-103263-12eca7a15774e06a 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-curlasynchttpclient-enforces-no-response-size-limit-decompression-bomb-drives-unbounded-memory-5bd95693dd109a2d 2026-10-29T21:44:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-curlasynchttpclient-leaks-per-request-credentials-on-handle-reuse-cve-2026-91992-3bd90ab11e2a9ede 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/sickchill-tornado-has-a-crlf-injection-in-curlasynchttpclient-headers-cve-2024-58384-c7ed096ab29d0a72 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-incomplete-fix-for-cve-2026-35536-cookie-attribute-injection-re-opened-via-the-legacy-case-e60b37c0e6a8075e 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-1f68b8ddea9f5f01 2026-10-29T21:44:32.000Z weekly 0.7 https://radar.offseq.com/threat/style-dictionary-prototype-pollution-in-converttokendata-utility-function-cve-2026-54639-2e1f5d6ea94f8502 2026-10-29T21:44:34.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-4cfefaed2c239eb7 2026-10-29T21:44:34.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-79e5ee35b3f1060b 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-312559a876597d5c 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/tach-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-ac87d4d7bbc7e453 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-9f00349722719235 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-74673febb6a3b3e6 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-252aa85db62326bb 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-a20ae2628fe1041e 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/tach-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-91b3397115b81718 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-fed678b3968ed849 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-bf58b860048d2554 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-write-and-097d08334e894bed 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-b0167882284ccdf8 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-985554d86a4135bd 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-0ed442da14e77069 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tach-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-0a916df758166910 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-48b011b8eefa54e3 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-3e58ba486d4dca3b 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-83962a11014683e4 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-04e817e9ea196408 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-1ea2db14ea6d6346 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-f09ab84fea4e2ca3 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-f40663a227ba7bf6 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-8ce3243fce63f6be 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-858fc4c4e6cf0a4d 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-7463f6d4dedd0b8a 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-b8d44604bc2b741e 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-e82333ecd8dbd786 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-d3d281e0ea4bee75 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-6f125fab61cf7bc4 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-53cf00e574078297 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-92467cb4dfe15232 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-a670fb8e3b308b79 2026-10-29T21:44:44.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-426b61b89d165e9d 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-73a5b307248fcddd 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-daa30351cab80db5 2026-10-29T21:44:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-922c31202a837ebd 2026-10-29T21:44:44.000Z weekly 0.8 https://radar.offseq.com/threat/tox-virtualenv-allows-command-injection-through-activation-scripts-for-a-virtual-environment-cve-2024-95d65a62336b32d1 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-cve-aa563972f22d6970 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/tox-virtualenv-bash-and-fish-activation-scripts-execute-commands-embedded-in-paths-cve-2026-102925-6247fd6a0c04d8ab 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-downloaded-seed-wheels-pipsetuptools-are-not-integrity-checked-before-use-cve-2026-102930-4cc54941266bdad9 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-virtualenv-writes-prompt-values-into-pyvenvcfg-without-sanitizing-line-boundaries-allowing-bced3a102b0c19ac 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-675a9f774f074ade 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-d2fb6d3b31d6a739 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-7a7222dc86cb0d2a 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-99a68b2b765b1115 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-9f697e4a8c72111c 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-9775323af5f248f8 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-7b6b364b3d434a2e 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-e9436d68436bc55c 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-3d1b234c72bd584f 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-14cac69e3522d846 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-79bc0f4107a9ccf7 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-0c38920bfbceba1d 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-d1ab71cbc9eaed56 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-5280c3aafe9288ad 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-596831c40e3bdf42 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-temporary-app-data-can-leave-dangling-seed-package-links-cve-2026-113713-536d9582c8065781 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-6395fff375f7963d 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-cb26598c110b1331 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-5d1169e5f56e3b31 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-a26399657b967a87 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-c6530396d41e6746 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/tox-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-cve-2026-478c700e78734bae 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-2026-113726-c1966c762c54569a 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-cve-5c294f50e5deb170 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-2026-113776-a1f1b2e9fd0480ff 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-ff9f8b17bf582f5e 2026-10-29T21:45:01.000Z weekly 0.8 https://radar.offseq.com/threat/tox-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-a3f232408f852e64 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/tox-virtualenv-has-toctou-vulnerabilities-in-directory-creation-cve-2026-22702-2af9694b19c9b73b 2026-10-29T21:45:01.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-035646838c4f3e0c 2026-10-29T21:45:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-beb882721ec4c34e 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-b5608aa4513f60a1 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-56d79b9089c8d46b 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-865419959bb9028f 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-a025bb4125abe88b 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-cd9e54de808b3e18 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-5b8f307b2aea9fdd 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-35a4f3591812cb27 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-98765b8930a4ae86 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-6ad15c3ef409d4f8 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-downloaded-wheel-selection-and-caching-precede-verification-cve-2026-113714-f875297bf37eae37 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-venv-configuration-readback-can-reinterpret-path-boundaries-cve-2026-113715-2cad1cabdfbf6615 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-5500bf0b38768bd5 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-pip-seeding-with-download-omits-wheel-digest-verification-cve-2026-113717-234171337c818e42 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-xonsh-activation-literals-depend-on-the-script-decoding-codec-cve-2026-113718-5731b43349330ba3 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-seed-replacement-does-not-contain-metadata-deletion-paths-cve-2026-113719-532f8c2a2ad5bd7b 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seeded-files-retain-permissions-from-an-older-cache-cve-2026-113720-d88a3c5a46a47089 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-6dc150dd3eac058e 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-5b631ae4d5a8d9c1 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-8184115e5062e106 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-201a1c2097603568 2026-10-29T21:45:34.000Z weekly 0.7 https://radar.offseq.com/threat/virtualfish-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-2b022237cfdb0ce2 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualfish-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-eb45065b324ac6b0 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualfish-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-c661ef5181245591 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualfish-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-3ee3374556ca29b3 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-de089e6ac588de44 2026-10-29T21:45:34.000Z weekly 0.8 https://radar.offseq.com/threat/vunnel-orjson-does-not-limit-recursion-for-deeply-nested-json-documents-cve-2024-27454-613509dda9b15614 2026-10-29T21:46:05.000Z weekly 0.8 https://radar.offseq.com/threat/vunnel-zipp-denial-of-service-vulnerability-cve-2024-5569-ac903d8c18587d3d 2026-10-29T21:46:05.000Z weekly 0.7 https://radar.offseq.com/threat/vunnel-orjson-does-not-limit-recursion-for-deeply-nested-json-documents-cve-2025-67221-86dd761ac7cbc3c2 2026-10-29T21:46:05.000Z weekly 0.8 https://radar.offseq.com/threat/gdown-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-cve-4fd401ba0b31069a 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-4c95d475a07096a6 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-2a27f90542aef60b 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-b8aa03fce4993fcd 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-88798750e139f519 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-5c115f6413477afd 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-26e76d4d775c018c 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-d91537bd3d98d66c 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-888a82f51fe9487b 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-f7dde77668cd4079 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-442f82d563e4db9f 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-446372c2ef9c5513 2026-10-29T21:46:08.000Z weekly 0.8 https://radar.offseq.com/threat/gdown-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-6ae453b7e508271f 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/gdown-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-41f5b387699de46c 2026-10-29T21:46:08.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-f32a4dc4fa844db6 2026-10-29T21:46:08.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-0a199a8604d69fee 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-ea11c0f88ea8fd01 2026-10-29T21:46:08.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-1877b0238eff5caf 2026-10-29T21:46:09.000Z weekly 0.8 https://radar.offseq.com/threat/weaviate-cli-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-3909b3b174818788 2026-10-29T21:46:15.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-jwsjwt-accepts-unknown-crit-headers-rfc-violation-possible-authz-bypass-cve-2025-59420-43e3a2493b99f96f 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/weaviate-cli-authlib-is-vulnerable-to-denial-of-service-via-oversized-jose-segments-cve-2025-61920-8a493a329f850b17 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-jwe-zipdef-decompression-bomb-enables-dos-cve-2025-62706-8358494845e2498c 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/weaviate-cli-authlib-has-1-click-account-takeover-vulnerability-cve-2025-68158-504f4350faae04c3 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-ba41a2bbdde77472 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/weaviate-cli-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-b0e809fd2e3d24c4 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/weaviate-cli-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-07eb169b7765cbb2 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-a3e6c7a2945974d3 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-e7de646b2fca04f8 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-58ac3719dec45e33 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-80648e44ccfc3955 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-dc68c4526aec482d 2026-10-29T21:46:15.000Z weekly 0.9 https://radar.offseq.com/threat/weaviate-cli-authlib-vulnerable-to-jwe-rsa15-bleichenbacher-padding-oracle-cve-2026-28490-feb4f44fea9ff6bc 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-fail-open-cryptographic-verification-in-oidc-hash-binding-cve-2026-28498-efbbcd56eb4f2bf8 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-setting-alg-none-and-a-blank-signature-appears-to-bypass-signature-verification-cve-2026-28802-3310277af3f75ed7 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-cross-site-request-forging-when-using-cache-cve-2026-41425-3730b37493dd66c2 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/weaviate-cli-authlib-oauth-20-has-open-redirect-in-authorization-api-that-allows-attacker-controlled-4a28398728e56e95 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/weaviate-cli-authlib-oidc-implicithybrid-authorization-vulnerable-to-open-redirect-cve-2026-44681-1d9bc03ec7389ab9 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-b64false-rfc7797-jws-payloads-bypass-jwsregistry-payload-size-limits-during-deserialization-3c183bc9da106b0c 2026-10-29T21:46:15.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-hs256hs384hs512-verify-accepts-emptynil-hmac-key-cross-language-sibling-of-cve-2026-45363-cve-b5d3dcc26e4d7359 2026-10-29T21:46:15.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-455318e500973d03 2026-10-29T21:46:15.000Z weekly 0.9 https://radar.offseq.com/threat/yt-dlp-exec-command-injection-when-using-q-in-yt-dlp-on-windows-cve-2024-22423-175251bc1ed1259d 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-and-youtube-dl-vulnerable-to-file-system-modification-and-rce-through-improper-file-extension-f18bf4d4a5f29fed 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-scrapy-is-vulnerable-to-a-denial-of-service-dos-attack-due-to-flaws-in-brotli-decompression-2c6adb6a94a22034 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-arbitrary-command-injection-when-using-the-netrc-cmd-option-cve-2026-26331-a288adff8ae48899 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-file-downloader-cookie-leak-with-curl-cve-2026-50019-3cd71679f3e00b71 2026-10-29T21:46:26.000Z weekly 0.7 https://radar.offseq.com/threat/yt-dlp-dangerous-file-type-creation-via-insufficient-filename-sanitization-bypass-of-cve-2024-38519-f90691a656b785ac 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-arbitrary-code-execution-via-manifest-downloads-with-aria2c-cve-2026-50574-f9251fff88f866ef 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-downstream-command-injection-via-improper-sanitization-of-yt-dlp-write-link-output-cve-2026-ab4589a670d287c2 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/yt-dlp-has-dependency-on-potentially-malicious-third-party-code-in-douyu-extractors-dd4369ac1bffaaa4 2026-10-29T21:46:26.000Z weekly 0.7 https://radar.offseq.com/threat/yt-dlp-arbitrary-command-injection-possible-if-exec-option-used-with-yt-dlp-f4102025b34f3f67 2026-10-29T21:46:26.000Z weekly 0.8 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-3c0e7b6e73b5c321 2026-10-29T21:47:01.000Z weekly 0.9 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-fc6f039abe3cc191 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-275bdf56e61af0e0 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-e702bd6d2c1e86a1 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-f86274f10482515e 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-6913a3edeaa892cf 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-827c0bb280874e8c 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-48d807e6b8ccc119 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-ba586b25699f20ce 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-f188bc5f837a17a1 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-8940de1f8cb5a912 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-971b166ee4cf443f 2026-10-29T21:47:48.000Z weekly 0.7 https://radar.offseq.com/threat/pipenv-virtualenv-allows-command-injection-through-activation-scripts-for-a-virtual-environment-cve-95ec20c5337d8db3 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-bash-and-fish-activation-scripts-execute-commands-embedded-in-paths-cve-2026-102925-a0176337884a6190 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-downloaded-seed-wheels-pipsetuptools-are-not-integrity-checked-before-use-cve-2026-102930-ed8446b58da6a8ca 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-writes-prompt-values-into-pyvenvcfg-without-sanitizing-line-boundaries-allowing-195501674d92ef54 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-24d94759644ba936 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-c74b213826966098 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-90ee22890ae97081 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-d0d38869798fe827 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-02fbacf5abe4f867 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-d815bcc056d133bb 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-498e6a467bd39a59 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-bd48957b5f4100da 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-80f1273431c57041 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-05eb1f8ea44c1abf 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-5b273be4bbfd617d 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-8f625d90a78fae76 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-b4bcc04cd36180a8 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-c23337b395c6cc4c 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-d7ab4cf6be8e74d2 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-temporary-app-data-can-leave-dangling-seed-package-links-cve-2026-113713-0148fe9645775e08 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-ccaecb89ffeddd26 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-fc7a373cfa8e4fd0 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-f9178a36e102c77d 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-c9f1f53f9f1b499d 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-5ff92ccce39b3b78 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/pipenv-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-cve-71c13888eb904719 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-2026-ed3e5ad02a291e8b 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-cve-91b2fdb2ec30976b 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-2026-01fcb6be5a3086fa 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-17388a2c51ca2207 2026-10-29T21:48:13.000Z weekly 0.8 https://radar.offseq.com/threat/pipenv-virtualenv-has-toctou-vulnerabilities-in-directory-creation-cve-2026-22702-405b37d3b449b383 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-da8c3e039550cd33 2026-10-29T21:48:13.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-d5d0ad04686e42b5 2026-10-29T21:48:42.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-3554a3376f7914e8 2026-10-29T21:48:42.000Z weekly 0.7 https://radar.offseq.com/threat/pyjwt-hs256384512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwkpyjwkclient-enabling-token-forgery-f5c1578bbcd333ee 2026-10-29T21:49:03.000Z weekly 0.8 https://radar.offseq.com/threat/recon-ng-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-dba3120a28e0a057 2026-10-29T21:49:41.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-eb379b758bd0ca9e 2026-10-29T21:50:08.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-1863ef58e9fc88ad 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-17a2b13fddb52036 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-9a3eb8e41244eb63 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-1338aca98e0c201b 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-670d6f54efb537f2 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-6336e694feb95d75 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-82487ff6149da7b0 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-aba7a77a23fb19d3 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-18523f42a363d043 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-9057f03169c8717f 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-5f4b6bdcaf8ed4c2 2026-10-29T21:50:11.000Z weekly 0.7 https://radar.offseq.com/threat/renovate-371580-before-371990-command-injection-via-helmv3-cve-2024-58376-6a8ad24438e2d927 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-43650-before-4310211-remote-code-execution-via-lockfilemaintenance-cve-2026-76226-90dce6c0da3171b5 2026-10-29T21:50:23.000Z weekly 0.7 https://radar.offseq.com/threat/renovate-42681-before-42963-and-4300-before-4344-environment-variable-exposure-cve-2026-76227-6cdbc8a0bc430330 2026-10-29T21:50:23.000Z weekly 0.7 https://radar.offseq.com/threat/renovate-before-42685-remote-code-execution-via-gradle-wrapper-cve-2026-76228-907f5156876af8b1 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-392180-before-40330-arbitrary-command-injection-via-kustomize-cve-2026-76229-9689bcc93a090561 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-35630-before-40330-command-injection-via-npm-cve-2026-76230-56e5a0737ceb0819 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-321350-before-40330-command-injection-via-hermit-cve-2026-76231-fc4d5d9bd2c42ede 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-31510-before-40330-command-injection-via-helmv3-cve-2026-76232-0e71bbf2f2449442 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/renovate-39530-before-40330-command-injection-via-gleam-manager-cve-2026-76233-802caa6eb38e4db2 2026-10-29T21:50:23.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-ffb149a88a1f9aa3 2026-10-29T21:51:12.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-01c0631350e90bc1 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-f3cb07c2e0bbaced 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-6476f886046d50b3 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-7c55e0f7a8dc7b0e 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-6bef548a98f248ed 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-e0cf16f02362847a 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-2922bbbcb6819363 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-7f21ecb19a7c6053 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-be5b101f053e326e 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-06250803fab46599 2026-10-29T21:51:46.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-325e0365ed4e31af 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/snowflake-cli-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-561b296bc5ae0ce5 2026-10-29T21:51:47.000Z weekly 0.8 https://radar.offseq.com/threat/snowflake-cli-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-1e4dab1682b5a07c 2026-10-29T21:51:47.000Z weekly 0.8 https://radar.offseq.com/threat/snowflake-cli-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-830db0bbaf18ff7d 2026-10-29T21:51:47.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-782375fdc3004097 2026-10-29T21:51:47.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-2113032ec112ac8f 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-550fc640d4a1d685 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-1a61c6b0ff55bc64 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-a8fcc32ae2863ce0 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-30506df9a18bf99f 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-2fe4f659fe03dabb 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-bcd4d9028b3d2d46 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-9d56293cdf39f502 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-e06564a4b08537df 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-63fb45f9f93dc394 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-6c6fc289148d9f8b 2026-10-29T21:51:47.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-f570606d454d18f7 2026-10-29T21:51:47.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-nltk-has-a-zip-slip-vulnerability-cve-2025-14009-d3db5e5302da101c 2026-10-29T21:52:04.000Z weekly 0.9 https://radar.offseq.com/threat/acronym-nltk-vulnerable-to-eval-injection-via-collocations-cli-arguments-cve-2025-71408-07d40042082711f0 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-has-arbitrary-file-read-via-absolute-path-input-in-nltkutilfilestring-cve-2026-0846-63933a66e3d266c6 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-has-a-path-traversal-issue-cve-2026-0847-10130d9c35370663 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-versions-392-are-vulnerable-to-arbitrary-code-execution-due-to-improper-input-cve-2026-1f331f0b3facf7d6 2026-10-29T21:52:04.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-wekaclassifier-passes-an-unvalidated-caller-controlled-model-path-to-the-weka-jvm-bypassing-bb4150a3f580aae8 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-redos-in-nltk-reviewscorpusreader-features-regex-cve-2026-12061-fbb9af569cb7ea60 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-path-traversal-in-nkjpcorpusreader-leads-to-arbitrary-file-read-597e583d09780426 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-has-path-traversal-in-framenetcorpusreaderframe-that-allows-6ee9fbb24025345d 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-dns-rebinding-ssrf-filter-bypass-in-nltkpathsecurlopen-726c50c7adac3160 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-stanford-wrapper-classes-execute-untrusted-jar-files-without-verification-cve-2026-12252-b6d43b9d3d3b1d7a 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-downloader-allows-cross-package-resource-and-model-poisoning-cve-2026-12261-59e639d308d6d8e1 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-nltk-network-url-validation-permits-ssrf-to-rfc-6598-shared-address-space-hosts-cve-2026-12372-fc8b8f6ab789cf77 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-uncontrolled-resource-consumption-in-recursivedescentparser-via-ambiguous-or-left-recursive-86811b0ed7c9f8e2 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-nltk-cve-20561e37a5f547a6 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-unauthenticated-remote-shutdown-in-nltkappwordnetapp-cve-2026-33231-53e1ca6b7c3622e7 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-has-a-downloader-path-traversal-vulnerability-afo-arbitrary-file-overwrite-cve-2026-33236-e5c7d4dcf7d2f9ac 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-url-encoded-path-traversal-in-nltkdataload-allows-arbitrary-0caf3197d79e2018 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-symlink-based-arbitrary-file-read-in-ipipancorpusreader-bypasses-nltkpathsec-entirely-cve-2026-7c9e7ab5db42eec1 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-symlink-based-sandbox-bypass-in-framenetcorpusreader-bypasses-the-fix-for-cve-2026-54292-cve-2026-244050481a598813 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-stable-framenet-and-nkjp-readers-parse-outside-root-xml-cve-2026-62385-cb97c44f5ec09370 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-default-enforcefalse-disables-all-pathsec-security-controls-cve-2026-62388-0c713227fb3e4a5d 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-ssrf-fail-open-in-validatenetworkurl-via-dns-resolution-failure-cve-2026-63311-ab2d00cc878fdbd3 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-streambackedcorpusview-bypasses-pathsecenforce-arbitrary-local-file-read-cve-2026-63312-cd8576febe7b187f 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-filesystempathpointeropen-sandbox-check-is-dead-code-arbitrary-file-read-via-file-protocol-38ec7cbcd8f4578e 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-natural-language-toolkit-nltk-has-unbounded-recursion-in-jsontaggeddecoderdecodeobj-may-cause-fb6c9c6cd6e69e28 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-symlink-escape-in-corpusreader-allows-arbitrary-local-file-read-outside-the-corpus-root-cve-2026-1ecc46d3107e8f20 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-nltk-allowlistunpickler-dotted-name-validation-bypass-allows-remote-code-execution-cve-2026-efe0c134cbc26617 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/acronym-nltk-crubadancorpusreader-path-traversal-allows-arbitrary-file-disclosure-cve-2026-71514-cf0dc91af16dbebd 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/acronym-nltk-tweettokenizer-vulnerable-to-denial-of-service-through-catastrophic-regex-backtracking-bae6b8a6066c58ed 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-uncontrolled-search-path-when-invoking-the-graphviz-dot-binary-cve-2026-78680-2aca5dcd27650938 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-entity-expansion-dos-billion-laughs-via-remaining-raw-elementtree-parses-cve-2026-78681-ade54c29cbe537ba 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-pathsec-ssrf-protection-can-be-bypassed-when-a-proxy-is-configured-cve-2026-78682-88b08acb0bfbdd22 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-unsafe-pickle-deserialization-in-transitionparser-allows-remote-code-execution-cve-2026-78683-c7c416243b784b7a 2026-10-29T21:52:04.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-allowlisted-pickle-loaders-still-permit-code-execution-in-current-source-cve-2026-79657-274260d2a1668290 2026-10-29T21:52:04.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-corpus-reader-sandbox-bypass-cve-2026-79674-5d9b2eb0278a9290 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-jvm-argument-injection-bypass-via-per-call-options-in-the-nltk-stanford-wrappers-incomplete-fix-of-f105cc6826df1a37 2026-10-29T21:52:04.000Z weekly 0.9 https://radar.offseq.com/threat/nltk-corpus-readers-follow-symlinks-outside-trusted-roots-despite-pathsec-enforcement-cve-2026-79676-4649744d38d01d45 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-redos-in-nltktexttextfindall-via-unvalidated-user-supplied-regular-expressions-cve-2026-80205-3fb850f45fbcbecc 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-redos-in-nltktgrep-via-unvalidated-user-supplied-regular-expressions-cve-2026-80206-660956125dde3502 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/nltk-quadratic-time-dos-in-porterstemmer-via-long-runs-of-y-cve-2026-81722-e1b9e04ec1691b5f 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-quadratic-cpu-exhaustion-in-xmlcorpusviewreadxmlfragment-cve-2026-81723-2c2f81d670c7a1bc 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-uncontrolled-recursion-in-nltkfeatstructfeatstructreader-causes-unhandled-recursionerror-dos-via-336ee59ee0288787 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-pl196xcorpusreader-has-quadratic-redos-on-malformed-tei-blocks-cve-2026-81725-7b4a0f6c2044d891 2026-10-29T21:52:04.000Z weekly 0.7 https://radar.offseq.com/threat/nltk-downloaderdownload-follows-hardlinks-and-overwrites-outside-root-files-cve-2026-81727-7f793db601b872e0 2026-10-29T21:52:04.000Z weekly 0.8 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-495fc8e9080a546d 2026-10-29T21:52:10.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-a8a66527e8b25091 2026-10-29T21:52:10.000Z weekly 0.7 https://radar.offseq.com/threat/xml2rfc-has-an-arbitrary-file-read-vulnerability-cve-2025-11058-6ed243bcf3d7a2b9 2026-10-29T21:52:23.000Z weekly 0.8 https://radar.offseq.com/threat/xml2rfc-is-vulnerable-to-arbitrary-file-reads-through-prepped-files-cve-2025-11059-c90e7265685fc13b 2026-10-29T21:52:23.000Z weekly 0.8 https://radar.offseq.com/threat/xml2rfc-has-file-inclusion-irregularities-bcf5b2dd762d827b 2026-10-29T21:52:23.000Z weekly 0.7 https://radar.offseq.com/threat/svg-with-embedded-scripts-can-lead-to-cross-site-scripting-attacks-in-xml2rfc-b84bcc852045c08f 2026-10-29T21:52:23.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-2b5109b3f0b9683a 2026-10-29T21:52:53.000Z weekly 0.7 https://radar.offseq.com/threat/shallow-backup-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-f42b0ff7fa9556ca 2026-10-29T21:52:53.000Z weekly 0.8 https://radar.offseq.com/threat/shallow-backup-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-10dba081fd56e769 2026-10-29T21:52:53.000Z weekly 0.8 https://radar.offseq.com/threat/shallow-backup-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-6b07fd959607d71f 2026-10-29T21:52:53.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-ab884fa85361622d 2026-10-29T21:52:53.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-503cb0f294c30f0b 2026-10-29T21:52:53.000Z weekly 0.7 https://radar.offseq.com/threat/ansible10-requests-vulnerable-to-netrc-credentials-leak-via-malicious-urls-cve-2024-47081-6e2b7991a6173972 2026-10-29T21:53:03.000Z weekly 0.7 https://radar.offseq.com/threat/ansible10-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-8e1ce38a0334fed0 2026-10-29T21:53:03.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-eb7cf3dab4543556 2026-10-29T21:53:03.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-79e0efcb1e01117a 2026-10-29T21:53:03.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-8b9e91f1bd4c7e2c 2026-10-29T21:54:58.000Z weekly 0.7 https://radar.offseq.com/threat/aws-google-auth-requests-vulnerable-to-netrc-credentials-leak-via-malicious-urls-cve-2024-47081-894f2eed87427721 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/aws-google-auth-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-6f62470f9e8f1b6b 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-evicts-a-fresh-lock-file-whose-watched-age-another-local-users-pre-dated-file-53a352be8578bc14 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-on-windows-an-oplock-on-a-soft-locks-marker-holds-softfilelockacquire-past-its-timeout-and-f710fda6fc51d902 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-68891a6fe39605d9 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-4f2253ae3a5adc1c 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-da47475009bda85c 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-0ab61017c3e8803d 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-windows-acts-on-sqlite-side-files-another-local-user-places-beside-its-974c8b53cdbaacef 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-break-restore-follows-a-swapped-in-symbolic-link-and-hard-links-a-file-of-63f4009f4ce07321 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-5637ff039108d4e7 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-9cdeb05b325cc8f3 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-d928889b2dd3e04b 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-bff355cd9b2912fd 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-the-hard-link-route-deletes-any-directory-another-user-renames-onto-its-4730c31b858c0db0 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-44ce0368acc2fe3e 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-959685cd911738d5 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-24251c2028e7ec47 2026-10-29T21:55:14.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-81943738925cb2f4 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/aws-google-auth-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-4bf8df48d1ae8470 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/aws-google-auth-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-7d44f8ce8247abac 2026-10-29T21:55:14.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-65b0f7a1e4d62b74 2026-10-29T21:55:14.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-abe220fe595f8c70 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-4269b8a892d678a9 2026-10-29T21:55:14.000Z weekly 0.7 https://radar.offseq.com/threat/aws-sso-util-requests-vulnerable-to-netrc-credentials-leak-via-malicious-urls-cve-2024-47081-70429897c0026fdb 2026-10-29T21:55:58.000Z weekly 0.7 https://radar.offseq.com/threat/keeper-commander-fpdf2-implicitly-loads-external-urls-and-local-image-paths-when-rendering-attacker-5aa1acb8940f13a1 2026-10-29T21:57:26.000Z weekly 0.7 https://radar.offseq.com/threat/fpdf2-exponential-svg-use-expansion-causes-cpu-and-memory-exhaustion-in-fpdfimage-cve-2026-114610-38a61f25f9f7cbd4 2026-10-29T21:57:26.000Z weekly 0.7 https://radar.offseq.com/threat/coconut-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-0039a11a786e3887 2026-10-29T21:58:09.000Z weekly 0.8 https://radar.offseq.com/threat/coconut-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-arbitrary-567170c0fa006a5a 2026-10-29T21:58:09.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-5435b31ddc2870f0 2026-10-29T21:58:09.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-21c11f29db1dcd39 2026-10-29T21:58:09.000Z weekly 0.7 https://radar.offseq.com/threat/aider-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-2f1ba665b1e7a76b 2026-10-29T21:58:10.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-7b954dd64582c354 2026-10-29T21:58:10.000Z weekly 0.7 https://radar.offseq.com/threat/aider-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-1190f5ab3d7aa0e3 2026-10-29T21:58:10.000Z weekly 0.8 https://radar.offseq.com/threat/aider-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-c4f6728336bb8bd2 2026-10-29T21:58:10.000Z weekly 0.8 https://radar.offseq.com/threat/aider-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-831926daf1db3f22 2026-10-29T21:58:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-3b2cec5f8a9bb325 2026-10-29T21:58:10.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-6591180c1e1b60d8 2026-10-29T21:58:10.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-aae522bdc8556850 2026-10-29T21:58:10.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-96a3eab402a051ea 2026-10-29T21:58:10.000Z weekly 0.7 https://radar.offseq.com/threat/aider-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-dd8f4330fa0c9c31 2026-10-29T21:58:10.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-infinite-loop-in-mic-nframes-when-the-embedded-tiff-cve-2026-112390-b4870922f1f5075d 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-pdfparser-can-recurse-without-limit-in-getvalue-and-linearizepagetree-cve-2026-112391-b835099cb72fcbf3 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-null-dereference-in-imagingexpand-via-rank-filters-on-zero-size-images-cve-2026-112392-55c1683f72dffc97 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-heap-buffer-overflow-in-tiffwriteproc-when-saving-tiff-to-bytesio-cve-2026-112393-3d244515df465b17 2026-10-29T21:58:11.000Z weekly 0.9 https://radar.offseq.com/threat/pillow-p2l-and-p4l-decoders-may-read-1-to-3-bytes-past-the-passed-buffer-size-cve-2026-112394-1831973544d3c000 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/aider-pillow-tiled-tiff-decoder-reads-past-tile-buffer-in-copy4-unpackc1290-cve-2026-112395-1fc7a95070273199 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-heap-use-after-free-when-encoding-tiff-to-an-in-memory-buffer-cve-2026-112396-d7b10ea6e1d7f573 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-out-of-bounds-access-in-imagingmorph-on-a-zero-width-image-cve-2026-112397-6eac6c1306f0a1f7 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-apng-background-disposal-allocates-full-canvas-before-decompression-bomb-check-cve-2026-112399-8fec972aec787a2a 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-gif-seek-keeps-rejected-size-after-decompressionbomberror-allowing-dos-cve-2026-112400-d3f64322dec4783e 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-quadratic-gif-comment-concatenation-allows-dos-in-imageopen-cve-2026-112401-bf92ddcdb5f2aa97 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-double-free-in-imagingscaleaffine-on-calloc-failure-via-imagetransform-cve-2026-112402-85c5289a2e7163a2 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-heap-buffer-overflow-in-imagingjpegdecode-cve-2026-112403-201aeaeb541b0319 2026-10-29T21:58:11.000Z weekly 0.9 https://radar.offseq.com/threat/pillow-oob-read-in-tiffdecodec-tile-and-rgba-paths-leaks-heap-memory-into-pixels-cve-2026-112404-2fec12c69be9fc75 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-null-pointer-dereference-in-imagemerge-via-an-unvalidated-band-0-cve-2026-112405-7ea2c46910b7acfa 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-infinite-loop-in-pdfparserrewritepages-on-page-tree-parent-cycle-cve-2026-112406-9066ad9f32d20150 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-quadratic-gif-comment-copying-during-save-cve-2026-112891-5bdca194fe0e1768 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-msp-rle-decoder-expands-a-tiny-file-into-unbounded-memory-cve-2026-112892-94c714d60f990f37 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-invalid-free-in-freetype-glyph-rendering-when-a-stroker-is-active-cve-2026-112893-37e6f2dceb57707a 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-quadratic-time-dos-in-pdf-saveall-pdfparsernextobjectid-cve-2026-112894-0ede3d90bd291e78 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-unbounded-recursion-parsing-a-pdf-page-tree-or-trailer-chain-incomplete-fix-for-cve-2026-42310-93abfa141e07420f 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-tiff-encoder-colormap-plane-size-mismatch-causes-a-heap-out-of-bounds-read-cve-2026-112896-96b6c1b15956692b 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-tiffdecode-returns-uninitialized-memory-as-pixels-for-short-jpeg-strips-cve-2026-112897-c33a1346d1de1f78 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-imagequantize-with-empty-palette-leaks-uninitialized-stack-memory-cve-2026-112898-4f2c6cbc3bf2bb80 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-argument-injection-in-ghostscript-call-potentially-leading-into-rce-cve-2026-112900-765fa94e1a99aaf2 2026-10-29T21:58:11.000Z weekly 0.9 https://radar.offseq.com/threat/pillow-redos-in-xbmimageplugin-512-byte-file-stalls-imageopen-for-minutes-cve-2026-112901-85c9f238ea8f0032 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-arrow-export-leaks-stale-heap-memory-when-pillowalignment-1-cve-2026-114501-0e7c26183e600bbd 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-decompression-bomb-protection-bypass-via-multi-frame-seek-in-mpo-and-dcx-mpoimagefileseek-650b24d0251b2f3b 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-decompression-bomb-check-bypass-in-spiderimagepluginseek-leads-to-unbounded-allocation-dos-cve-475c72145dc395f7 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-bmp-rle-decoder-memory-amplification-dos-via-unbounded-delta-escape-absolute-mode-cve-2026-96638-964535d78e1a0c0b 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/aider-pillow-multi-frame-loaders-can-reuse-stale-native-image-storage-after-mode-transitions-cve-2026-0dd38b82f972c553 2026-10-29T21:58:11.000Z weekly 0.9 https://radar.offseq.com/threat/aider-pillow-pdf-append-accepts-malformed-shared-page-tree-dag-causing-resource-exhaustion-cve-2026-0ca98bc12ec2a37b 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-reachable-undefined-behavior-in-native-integer-operations-potentially-leading-to-denial-of-c820e68d17c49f28 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/pillow-tario-negative-size-field-causes-infinite-cpu-spin-loop-cve-2026-96642-f46133c8a4ba1c71 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-png-exif-chunk-makes-exif-parsing-run-in-quadratic-time-cve-2026-96643-db9dd4918ee2d6de 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/pillow-heap-buffer-overflow-writing-jpeg-comment-after-icc-profile-fills-buffer-cve-2026-96778-b3424ef00ac19b34 2026-10-29T21:58:11.000Z weekly 0.8 https://radar.offseq.com/threat/aider-litellm-vulnerable-to-reflected-xss-in-ssodebugcallback-920b771c26dd4b87 2026-10-29T21:58:11.000Z weekly 0.7 https://radar.offseq.com/threat/aqtinstall-scrapy-is-vulnerable-to-a-denial-of-service-dos-attack-due-to-flaws-in-brotli-decompression-7ad6ab72346682fe 2026-10-29T21:58:12.000Z weekly 0.8 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-045b3c3ac350018f 2026-10-29T21:58:32.000Z weekly 0.9 https://radar.offseq.com/threat/py7zr-arbitrary-file-write-vulnerability-cve-2026-23879-fc4f12bce09be088 2026-10-29T21:58:32.000Z weekly 0.8 https://radar.offseq.com/threat/aqtinstall-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-6e51c870c1040011 2026-10-29T21:58:32.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-be7c5414af44cfbc 2026-10-29T21:58:32.000Z weekly 0.8 https://radar.offseq.com/threat/py7zr-decompression-bomb-zip-bomb-denial-of-service-via-unchecked-extraction-size-cve-2026-55195-d2694b74f49b34e0 2026-10-29T21:58:32.000Z weekly 0.7 https://radar.offseq.com/threat/py7zr-on2-algorithmic-complexity-dos-in-packinforead-cve-2026-55206-9d0c6847aea37d3a 2026-10-29T21:58:32.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-1ab8f23676846494 2026-10-29T21:58:32.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-7e854177b6bd980f 2026-10-29T21:58:32.000Z weekly 0.7 https://radar.offseq.com/threat/bbot-ansible-core-information-disclosure-flaw-cve-2024-0690-d5ab5a9a295cf006 2026-10-29T21:59:18.000Z weekly 0.7 https://radar.offseq.com/threat/bbot-ansible-core-vulnerable-to-content-protections-bypass-cve-2024-11079-3782fda8e63f4e4c 2026-10-29T21:59:18.000Z weekly 0.7 https://radar.offseq.com/threat/bbot-ansible-vulnerable-to-insertion-of-sensitive-information-into-log-file-cve-2024-8775-23d049b8a132901d 2026-10-29T21:59:18.000Z weekly 0.7 https://radar.offseq.com/threat/bbot-ansible-core-incorrect-authorization-vulnerability-cve-2024-9902-28c76859ac78d8ae 2026-10-29T21:59:18.000Z weekly 0.7 https://radar.offseq.com/threat/bbots-insufficient-sanitization-issues-in-gitdumperpy-can-lead-to-rce-cve-2025-10283-699ce1903d9090ee 2026-10-29T21:59:18.000Z weekly 0.9 https://radar.offseq.com/threat/bbots-various-issues-in-unarchivepy-can-cause-arbitrary-file-write-and-rce-cve-2025-10284-d54122d7fa7594be 2026-10-29T21:59:18.000Z weekly 0.9 https://radar.offseq.com/threat/ansible-core-argument-injection-in-ansible-galaxy-role-install-leads-to-arbitrary-code-execution-cve-cb7d55d9a8e109d6 2026-10-29T21:59:18.000Z weekly 0.8 https://radar.offseq.com/threat/streamlink-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-eb18ad3452bcd259 2026-10-29T21:59:33.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-0732cbaed8cdafae 2026-10-29T21:59:51.000Z weekly 0.8 https://radar.offseq.com/threat/bbot-deepdiff-class-pollution-in-delta-class-leading-to-dos-remote-code-execution-and-more-cve-2025-961d54b4714ec123 2026-10-29T22:00:18.000Z weekly 0.9 https://radar.offseq.com/threat/bbot-orjson-does-not-limit-recursion-for-deeply-nested-json-documents-cve-2025-67221-b0e4786d6dd16bb5 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/bbot-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-cve-5804776704846c21 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-dd9fd7f615d72585 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-6d96936b475c42ee 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-739ab9ab78a3ba2a 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-a7348f3bff53dc6b 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-8333fd2e36b6c920 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-c8ccd3172c954825 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-23681b8ad06cf579 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-380681b29afce308 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-2d3bc36ad805d8c4 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-3274fa5c41a14d2f 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-ee09b35e38c9870a 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/bbot-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-c7c5efa25150977c 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/bbot-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-92f41af6199b4237 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/bbot-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-52bdf5e9ff1981ec 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-e50bec009b4f28b7 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-0769b750e3fbf782 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-e48a66c41ff26a87 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-24d83fa3b0fb19c6 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/cve-bin-tool-aiohttp-server-lacks-an-initial-requestheader-timeout-cve-2026-111064-cc3a6f8fef87a359 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-connector-pool-exhaustion-via-max-age-overflow-cve-2026-111065-7fe8b5bf4994f873 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-file-descriptor-exhaustion-in-multipart-requests-cve-2026-111066-6b42c1295194f6d2 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-81c7e0ded839c971 2026-10-29T22:00:18.000Z weekly 0.9 https://radar.offseq.com/threat/aiohttp-absolute-form-request-targets-can-spoof-requestscheme-cve-2026-111748-718253e24dbe7779 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-cookie-from-subdomain-can-remove-host-only-scope-from-existing-cookies-cve-2026-111749-30d3fbfa597b01cd 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-pure-python-parser-request-smuggling-cve-2026-111750-da44e616b0bd67ed 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-d8b103e5fe39b528 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-d79193b44a321447 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-4e1decafa7c2a5af 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-multiple-instances-of-excessive-or-unbounded-memorycpu-use-9aa6260b161ec3fc 2026-10-29T22:00:18.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-58a3d78b26cade80 2026-10-29T22:00:18.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-a58ba74b09ef11e9 2026-10-29T22:00:30.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-1e75b1c305f1d709 2026-10-29T22:00:30.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-server-kubernetes-potential-security-issue-in-execinpod-tool-cve-2025-66404-5f373b2ba3cafe72 2026-10-29T22:00:50.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-server-kubernetes-has-argument-injection-in-its-portforward-tool-via-space-splitting-cve-2026-39884-c3f38fb967ecff93 2026-10-29T22:00:50.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-server-kubernetes-affected-by-tool-access-control-bypass-presentation-layer-filtering-without-e5ef7bd5d3cee83f 2026-10-29T22:00:50.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-server-kubernetes-kubectl-generic-flag-injection-enables-kubernetes-bearer-token-exfiltration-cve-15fbbdbfe91ecd88 2026-10-29T22:00:50.000Z weekly 0.7 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-allow-memory-exhaustion-by-allocating-one-entry-per-index-25d0d13d2cea680d 2026-10-29T22:00:54.000Z weekly 0.8 https://radar.offseq.com/threat/biber-textcsvxs-versions-from-146-before-165-for-perl-have-a-use-after-free-of-bindcolumns-variables-b63e436c78ec5267 2026-10-29T22:00:54.000Z weekly 0.9 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-leak-the-parsed-fields-of-a-record-that-fails-to-parse-in-0802b6105e51ae5f 2026-10-29T22:00:54.000Z weekly 0.7 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-allow-quadratic-cpu-use-by-copying-the-unparsed-remainder-15939802f9c8e45e 2026-10-29T22:00:54.000Z weekly 0.8 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-drop-the-end-of-a-record-and-its-line-ending-when-a-utf-8-786463efc2cf70ce 2026-10-29T22:00:54.000Z weekly 0.9 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-allow-record-splitting-by-writing-strings-used-as-numbers-6c73325cd41a6e6c 2026-10-29T22:00:54.000Z weekly 0.9 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-read-before-the-start-of-an-all-blank-field-under-e47a3fb0ac4f39fc 2026-10-29T22:00:54.000Z weekly 0.8 https://radar.offseq.com/threat/biber-textcsvxs-versions-before-165-for-perl-return-a-0xff-byte-that-is-not-in-the-input-for-an-empty-9b3660e4eb8ec452 2026-10-29T22:00:54.000Z weekly 0.9 https://radar.offseq.com/threat/biber-mozillaca-versions-before-20261020-for-perl-provide-a-ca-certificate-bundle-containing-a-root-cfb98cbfaf56d4dd 2026-10-29T22:00:54.000Z weekly 0.7 https://radar.offseq.com/threat/defuddle-vulnerable-to-xss-via-unescaped-attribute-interpolation-in-site-extractors-cve-2026-61824-23e5f6d962bab63f 2026-10-29T22:01:29.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-untrusted-search-path-under-some-conditions-on-windows-allows-arbitrary-code-execution-3b1b0c22c65e926f 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-851873f7d997d6cc 2026-10-29T22:01:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-810c7aaebc751f31 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-1fe832db0decb8f6 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-b2d43669de6f593a 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-78381feb40009f53 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-008dce79785a0d08 2026-10-29T22:01:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-2c3adfd4116fb8c2 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-113d99540ef7154b 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-7d01b1c925a8fcad 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-a5dfae38b8c3d947 2026-10-29T22:01:44.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-0dc0c292c2a87878 2026-10-29T22:01:44.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-42377cd4e4e755c7 2026-10-29T22:01:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-42e79084bf4f212b 2026-10-29T22:01:44.000Z weekly 0.7 https://radar.offseq.com/threat/certbot-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-f7bf88d3b6ed07a2 2026-10-29T22:01:47.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-fdf807ae8da4f3f0 2026-10-29T22:02:27.000Z weekly 0.7 https://radar.offseq.com/threat/fdroidserver-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-9995085efd5ba8b5 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-a8f7f29039b6f198 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-e65961f8bac8ece5 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-2ad2d923b56ac8f7 2026-10-29T22:02:27.000Z weekly 0.7 https://radar.offseq.com/threat/fdroidserver-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-b50874a87faef992 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-ee258778c0f00fbd 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-4d7fa10299a5885d 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-9762a2206ea1a44c 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-paramiko-rsakeypy-allows-the-sha-1-algorithm-cve-2026-44405-f6ea326c562ac91d 2026-10-29T22:02:27.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-6dcaf501b9952384 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-3c237c99614731de 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/fdroidserver-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-ef408cf3f8587ba0 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-9c2c55132dd9d52a 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-c6129eed41d52721 2026-10-29T22:02:27.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-6e489d7b8c15e90f 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-overwrite-via-git-diff-output-argument-injection-in-diffablediff-key-and-182932f67df08a7f 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-6d5c850917eaa1e2 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-4758119640ced75b 2026-10-29T22:02:27.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-7dda0c372256cfe8 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-0fce656de9ca911c 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-4567c797aefbe50d 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-d4150e8574e4d32c 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-8cd6c92631425b3d 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-4b667c20dcde7ca3 2026-10-29T22:02:27.000Z weekly 0.8 https://radar.offseq.com/threat/git-annex-checksum-exposure-to-encrypted-special-remotes-0e67fcb813c45632 2026-10-29T22:02:34.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-7ed4925e84716e51 2026-10-29T22:03:10.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-for-python-out-of-bounds-read-crash-on-unpacker-reuse-after-a-caught-error-cve-2026-57585-c028e0e8deab998c 2026-10-29T22:03:10.000Z weekly 0.8 https://radar.offseq.com/threat/magic-wormhole-autobahn-python-permessage-deflate-bypasses-maxmessagepayloadsize-after-inflation-cve-3148ae786e9089e1 2026-10-29T22:03:25.000Z weekly 0.7 https://radar.offseq.com/threat/get-iplayer-mojolicious-versions-from-0999922-for-perl-uses-a-hard-coded-string-or-the-applications-84200046e7a4ab76 2026-10-29T22:04:09.000Z weekly 0.8 https://radar.offseq.com/threat/get-iplayer-mojojson-versions-before-947-for-perl-allow-memory-exhaustion-via-unbounded-recursion-in-ee4a9a118f342f68 2026-10-29T22:04:09.000Z weekly 0.7 https://radar.offseq.com/threat/get-iplayer-mojolicious-versions-from-459-before-948-for-perl-expose-a-stable-representation-of-the-34a8170468842c8a 2026-10-29T22:04:09.000Z weekly 0.9 https://radar.offseq.com/threat/dnsviz-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-f54bc09da3a6f939 2026-10-29T22:04:38.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-28b62135d55c06dd 2026-10-29T22:04:38.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-b13a4028fc88e06e 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-5eea592cd5619d7f 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-09ac19ca1956973a 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-0d3f38c10485fe6f 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-f15fd3b6250aa66c 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-db3101da5584f5f9 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-1fae4e7662391239 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-7be3171e96738e21 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-cc4634274b233f37 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-97201e7de09c92d0 2026-10-29T22:04:46.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-444a21f89a70fabd 2026-10-29T22:04:46.000Z weekly 0.8 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-ccd12f2c117fe79e 2026-10-29T22:04:48.000Z weekly 0.9 https://radar.offseq.com/threat/bzt-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-c7b752481217b889 2026-10-29T22:05:23.000Z weekly 0.9 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-4daf6ed52aa9b63d 2026-10-29T22:05:23.000Z weekly 0.7 https://radar.offseq.com/threat/multidict-reference-leak-in-cimultidictmultidict-items-view-union-and-subtraction-cve-2026-104874-de2e6008a60c0097 2026-10-29T22:06:00.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-746d992c3233fd00 2026-10-29T22:06:00.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-3e7ca95796eb0cf9 2026-10-29T22:06:00.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-9b0a3a594a0f3a81 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/twisted-denial-of-service-in-the-twisted-imap4-server-via-a-negative-literal-size-in-search-cve-2026-9a439d3f38bb1c3a 2026-10-29T22:06:48.000Z weekly 0.7 https://radar.offseq.com/threat/twisted-unauthenticated-remote-denial-of-service-in-the-twisted-words-domish-xml-element-stream-via-an-bca1d7fda15096d8 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/twisted-unauthenticated-remote-denial-of-service-in-the-twisted-irc-server-via-an-unbounded-line-buffer-f75a440f6da91416 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/twisted-unauthenticated-remote-denial-of-service-in-the-twisted-conch-telnet-transport-via-an-unbounded-a9deed88d88427ee 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/twisted-http-request-smuggling-in-twistedweb-via-a-bare-cr-or-lf-in-a-header-value-cve-2026-115877-a4e850a3e0ef374a 2026-10-29T22:06:48.000Z weekly 0.7 https://radar.offseq.com/threat/autobahn-python-permessage-brotli-inflates-a-whole-frame-before-maxmessagepayloadsize-is-checked-683cee086b308cb7 2026-10-29T22:06:48.000Z weekly 0.7 https://radar.offseq.com/threat/messagepack-for-python-out-of-bounds-read-crash-on-unpacker-reuse-after-a-caught-error-cve-2026-57585-668e1e223fd2a3af 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/twisted-dns-response-spoofing-in-twistednames-due-to-missing-source-address-validation-cve-2026-83813-3d47d8177a086f39 2026-10-29T22:06:48.000Z weekly 0.7 https://radar.offseq.com/threat/twisted-unauthenticated-remote-denial-of-service-in-the-twisted-http2-server-via-rapid-stream-reset-76e3e8a464e65c33 2026-10-29T22:06:48.000Z weekly 0.8 https://radar.offseq.com/threat/gdbgui-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-0d64753e925d22d4 2026-10-29T22:07:45.000Z weekly 0.9 https://radar.offseq.com/threat/brotli-out-of-bounds-write-in-the-brotli-decoder-node2shell-also-affects-the-pypi-brotli-package-cve-a53212cc598ffba9 2026-10-29T22:07:45.000Z weekly 0.9 https://radar.offseq.com/threat/gdbgui-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-f428d5a807304252 2026-10-29T22:07:45.000Z weekly 0.8 https://radar.offseq.com/threat/fastmcp-oauth-proxy-token-reuse-across-mcp-servers-cve-2025-69196-bf5758246fcaa2a8 2026-10-29T22:08:45.000Z weekly 0.8 https://radar.offseq.com/threat/fastmcp-starlette-vulnerable-to-on2-dos-via-range-header-merging-in-starletteresponsesfileresponse-a6ea60a8e8e5d1a7 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/fastmcp-vulnerable-to-reflected-xss-in-clients-callback-page-cve-2025-62800-e59b1803b91d7191 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-cursor-installer-via-servername-cve-2025-d975906942765447 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-has-a-command-injection-vulnerability-gemini-cli-cve-2025-64340-597b0e0e3d377265 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-9419ff4aaa688b42 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-3b3ae2d71d7e5ddc 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-cve-61dcd77d4127516c 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/fastmcp-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-cve-2026-b3cd14b9d659e25b 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-17faf62519875b53 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-0d35e4aa825a6833 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-8b3ca61a0e6f66df 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-c15101e8890150dc 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-f159189e9bf77f92 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-8c8f147194a3a170 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-missing-consent-verification-in-oauth-proxy-callback-facilitates-confused-deputy-2e86edf77da563d3 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-406a6a013b918e98 2026-10-29T22:09:40.000Z weekly 0.9 https://radar.offseq.com/threat/fastmcp-openapi-provider-has-an-ssrf-path-traversal-vulnerability-cve-2026-32871-02ac6f6945909058 2026-10-29T22:09:40.000Z weekly 0.9 https://radar.offseq.com/threat/fastmcp-starlette-has-missing-host-header-validation-that-poisons-requesturlpath-bypassing-path-based-a67b8fa0cd9c67ba 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-arbitrary-http-method-dispatched-to-httpendpoint-attributes-via-getattr-cve-2026-48817-967b8fa582ba4b40 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-unvalidated-request-path-concatenated-into-authority-poisons-requesturlhostname-cve-2026-837ab790f8ced6a4 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/starlette-requestform-limits-silently-ignored-for-applicationx-www-form-urlencoded-enable-dos-cve-2026-e595f7357a7db866 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-b024a7c810767ba9 2026-10-29T22:09:40.000Z weekly 0.9 https://radar.offseq.com/threat/fastmcp-post-transform-component-authorization-is-skipped-on-direct-calls-f34a5dd63cec4460 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-auth-integration-allows-for-confused-deputy-account-takeover-aa7e424c38303cac 2026-10-29T22:09:40.000Z weekly 0.8 https://radar.offseq.com/threat/fastmcp-mcp-client-wrappers-construct-m2m-oauth-providers-without-issuer-binding-client-secret-d732d59d91c8edf5 2026-10-29T22:09:40.000Z weekly 0.7 https://radar.offseq.com/threat/mentat-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-347c4f159ccd220b 2026-10-29T22:09:59.000Z weekly 0.9 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-f1588437a507efd5 2026-10-29T22:09:59.000Z weekly 0.7 https://radar.offseq.com/threat/mentat-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-d7f3d331ab3d957b 2026-10-29T22:09:59.000Z weekly 0.8 https://radar.offseq.com/threat/mentat-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-28644234ef9b2e4c 2026-10-29T22:09:59.000Z weekly 0.8 https://radar.offseq.com/threat/mentat-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-f78eb28e1458d01a 2026-10-29T22:09:59.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-e18859c61292b928 2026-10-29T22:09:59.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-fb6c4593c31ac2c2 2026-10-29T22:09:59.000Z weekly 0.7 https://radar.offseq.com/threat/mycli-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-90dad0f72655f9f6 2026-10-29T22:11:41.000Z weekly 0.9 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-848f8d4dd54671ac 2026-10-29T22:13:00.000Z weekly 0.7 https://radar.offseq.com/threat/hermes-agent-aiohttp-server-lacks-an-initial-requestheader-timeout-cve-2026-111064-f947fd9b52711ed4 2026-10-29T22:13:00.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-connector-pool-exhaustion-via-max-age-overflow-cve-2026-111065-c398d18feff20107 2026-10-29T22:13:00.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-file-descriptor-exhaustion-in-multipart-requests-cve-2026-111066-68fd55156c15a93f 2026-10-29T22:13:00.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-absolute-form-request-targets-can-spoof-requestscheme-cve-2026-111748-532fcf51137959cb 2026-10-29T22:13:00.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-cookie-from-subdomain-can-remove-host-only-scope-from-existing-cookies-cve-2026-111749-7434bae300c94931 2026-10-29T22:13:00.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-pure-python-parser-request-smuggling-cve-2026-111750-62d117d9457f1935 2026-10-29T22:13:00.000Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-multiple-instances-of-excessive-or-unbounded-memorycpu-use-55cb5106e6231afd 2026-10-29T22:13:00.000Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-0a93fba079bdecea 2026-10-29T22:13:09.000Z weekly 0.7 https://radar.offseq.com/threat/omnara-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-cve-a5f714147bf99481 2026-10-29T22:13:09.000Z weekly 0.8 https://radar.offseq.com/threat/omnara-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-cve-2026-13b156bb8e15bae4 2026-10-29T22:13:09.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-3403eda229536819 2026-10-29T22:13:09.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-8767a7fb5898a8e5 2026-10-29T22:13:09.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-894cb30e6407b88e 2026-10-29T22:13:09.000Z weekly 0.9 https://radar.offseq.com/threat/jupyterlab-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-9bb52aa13d639652 2026-10-29T22:13:44.000Z weekly 0.9 https://radar.offseq.com/threat/jupyterlab-mistune-has-a-redos-in-linktitlere-that-allows-denial-of-service-via-crafted-markdown-input-fdb64f8e2946a205 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-nbconvert-has-an-arbitrary-file-write-via-path-traversal-in-cell-attachment-filenames-cve-563fa55d5f95569d 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-nbconvert-has-an-arbitrary-file-read-via-path-traversal-in-htmlexporter-image-embedding-cve-71266c6b7846ba13 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-mistune-math-plugin-has-an-xss-escape-bypass-cve-2026-44708-a9fcc85fd9b6188f 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-mistune-has-xss-via-unescaped-figclassfigwidth-in-figure-directive-cve-2026-44896-ed1207ccdd669cca 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-mistune-heading-id-attribute-has-injection-xss-cve-2026-44897-50081bedbf4c83f7 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-mistune-toc-anchor-injection-xss-cve-2026-44898-fb136855ed7dd45f 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-mistune-image-directive-css-injection-vulnerability-cve-2026-44899-ae8a131f250f832c 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-potential-dos-via-quadratic-time-parsing-in-parselinktext-cve-2026-49851-316523ff10b40531 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/mistune-pluginsformatting-quadratic-time-parsing-on-long-runs-of-x-x-and-x-markers-9523fb9a72bcc150 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/mistune-xss-via-percent-encoded-javascript-uri-bypass-in-safeurl-cve-2026-59923-bea239fc1405a9ab 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-arbitrary-file-read-via-include-directive-path-traversal-cve-2026-59924-1e025c5ed7098e4c 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-inlineparser-quadratic-time-parsing-on-long-runs-of-x-and-x-emphasis-pairs-cve-2026-59925-647b5a7c78209c16 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/mistune-xss-via-unescaped-class-option-in-admonition-directive-cve-2026-59926-2f5a498accf5246a 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-directivesinclude-mutual-cve-2026-59927-6453c501d66b4c11 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-blockparser-quadratic-time-parsing-on-long-lists-of-repeated-reference-link-definitions-cve-bfb5d0e51961616f 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/mistune-renderershtmlsafeurl-harmfulprotocols-list-misses-legacy-and-chained-schemes-that-historically-67d170a98d740d77 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-toc-tableofcontents-directive-heading-ids-use-predictable-tocn-numbering-with-no-slugification-31fed20e6a76a391 2026-10-29T22:13:44.000Z weekly 0.7 https://radar.offseq.com/threat/mistune-denial-of-service-recursionerror-via-excessive-emphasis-markers-in-markdown-cve-2026-76098-ade2d06678374c12 2026-10-29T22:13:44.000Z weekly 0.8 https://radar.offseq.com/threat/pyjwkclient-missing-scheme-allowlist-enables-cve-2024-21643-class-ssrf-token-forgery-via-file-ftp-data-5b7287171f842db6 2026-10-29T22:13:56.000Z weekly 0.7 https://radar.offseq.com/threat/pyjwt-algorithm-allow-list-bypass-when-decoding-with-pyjwk-pyjwkclient-keys-cve-2026-48523-65ebe05064bdaf16 2026-10-29T22:13:56.000Z weekly 0.7 https://radar.offseq.com/threat/hermes-agent-pyjwkclient-unbounded-jwks-endpoint-requests-via-attacker-controlled-kid-values-dos-cve-9e37e27df386c0f1 2026-10-29T22:13:56.000Z weekly 0.7 https://radar.offseq.com/threat/pyjwt-unauthenticated-dos-via-unbounded-base64url-decoding-of-unused-payload-segment-in-b64false-eab01407d2ff88af 2026-10-29T22:13:56.000Z weekly 0.7 https://radar.offseq.com/threat/pyjwt-public-key-jwk-accepted-as-hmac-secret-enables-forged-hs256-tokens-when-mixed-families-are-d9d3a44530f1cb45 2026-10-29T22:13:56.000Z weekly 0.8 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-6a1f2e9970eeab59 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-2edf3e2634eb017c 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-601dae12f01d0c85 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-8a40e4271949d3f1 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-902a13ac3dc91b19 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-1c270f8aed290408 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-7b9f8298bfdc9e52 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-c3620c8b2faf021d 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-4d49679cf0548338 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-e2a11bcc45bca0bc 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-follows-a-lock-tree-swapped-in-after-its-first-acquire-and-writes-lock-4d0bcf830b7b1df3 2026-10-29T22:13:59.000Z weekly 0.7 https://radar.offseq.com/threat/glances-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-0f7ecee213a4777a 2026-10-29T22:14:00.000Z weekly 0.9 https://radar.offseq.com/threat/jupyterlab-tornado-has-an-http-cookie-parsing-dos-vulnerability-cve-2024-52804-9791763a0811c594 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-tornado-vulnerable-to-excessive-logging-caused-by-malformed-multipart-form-data-cve-2025-e029ebf554d2087c 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-nbconvert-has-an-uncontrolled-search-path-that-leads-to-unauthorized-code-execution-on-82931730c3f7bf36 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-tornado-vulnerable-to-header-injection-and-xss-via-reason-argument-cve-2025-67724-f630bd300ec8453e 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-dos-via-repeated-header-coalescing-cve-2025-67725-3fae9baf43bfa70d 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-quadratic-dos-via-crafted-multipart-parameters-cve-2025-67726-ab71e39fb4bb29f9 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-unbounded-query-string-argument-count-allows-event-loop-stalling-dos-cve-2026-103261-5ca83f12b33f36d6 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-curlasynchttpclient-enforces-no-response-size-limit-decompression-bomb-drives-unbounded-memory-89e83acc22830982 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-staticfilehandler-follows-symlinks-outside-static-root-path-traversal-cve-2026-103263-046cd4b4087dc3e1 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/nbconvert-arbitrary-file-write-through-path-traversal-in-cell-output-filenames-when-exporting-to-md-dcef217343d9f8bf 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-event-loop-blocking-and-excess-memory-use-from-chunked-bodies-with-many-small-chunks-cve-2026-5ab53dd3b792dbf1 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-quadratic-cpu-usage-when-parsing-http-headers-with-line-folding-cve-2026-116577-2c427dcd4d28068a 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-open-redirect-in-redirecthandler-via-protocol-relative-urls-cve-2026-116578-f107de7436b70f4c 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-tornado-is-vulnerable-to-dos-due-to-too-many-multipart-parts-cve-2026-31958-458dac66d9b37691 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-tornado-has-incomplete-validation-of-cookie-attributes-cve-2026-35536-7c4411d0f4f38f73 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-0b231bfbfdceeeef 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-adc9cd195bb062b7 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-authorization-header-forwarded-across-cross-origin-redirects-in-simpleasynchttpclient-cve-2026-2be2ed3a50462860 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/jupyterlab-tornado-has-out-of-bounds-memory-access-via-c-extension-cve-2026-49854-b1504c008d8b923c 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-tornado-asynchttpclient-accumulates-decompressed-chunks-without-size-limit-gzip-bomb-cve-ebd5d7051883001c 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/tornado-urlencoded-body-parsing-omits-maxnumfields-so-one-request-can-stall-the-event-loop-cve-2026-32c43b3c25b980d2 2026-10-29T22:14:32.000Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-4e11e6c0e40dd051 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-ff0e1d0a366b4f5c 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-inconsistent-interpretation-of-http-requests-http-requestresponse-smuggling-in-tornado-cve-6f6af80fcf5f0f77 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-multipart-split-creates-huge-temp-list-before-maxparts-check-memory-amplification-dos-4a344bf54e334a6b 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-curlasynchttpclient-leaks-per-request-credentials-on-handle-reuse-cve-2026-91992-f81528dcf6a6e0d3 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/jupyterlab-tornado-has-a-crlf-injection-in-curlasynchttpclient-headers-cve-2024-58384-3740fe986ea37c5e 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/tornado-incomplete-fix-for-cve-2026-35536-cookie-attribute-injection-re-opened-via-the-legacy-case-3a75d8c4c64af44d 2026-10-29T22:14:32.000Z weekly 0.7 https://radar.offseq.com/threat/omnara-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-159d70984bda43c8 2026-10-29T22:14:53.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-4ba33b5861b3d8dc 2026-10-29T22:14:53.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-30f21a6c1fa96eb5 2026-10-29T22:14:53.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-97fcbc9e42740d54 2026-10-29T22:14:53.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-690996977b47672f 2026-10-29T22:14:53.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-6b5e59b7c8594736 2026-10-29T22:14:53.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-4819485c3ac4fe27 2026-10-29T22:14:53.000Z weekly 0.9 https://radar.offseq.com/threat/omnara-fastmcp-openapi-provider-has-an-ssrf-path-traversal-vulnerability-cve-2026-32871-879a060735d2b83c 2026-10-29T22:14:53.000Z weekly 0.9 https://radar.offseq.com/threat/mycli-setuptools-vulnerable-to-command-injection-via-package-url-cve-2024-6345-a257c0046eaa9feb 2026-10-29T22:15:44.000Z weekly 0.8 https://radar.offseq.com/threat/mycli-setuptools-has-a-path-traversal-vulnerability-in-packageindexdownload-that-leads-to-arbitrary-1bf5f0e074ccf47c 2026-10-29T22:15:44.000Z weekly 0.8 https://radar.offseq.com/threat/setuptools-manifestin-exclusion-bypass-in-sdist-via-unicode-normalization-collision-nfcnfd-on-macos-97df2175b9021fa2 2026-10-29T22:15:44.000Z weekly 0.7 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-4fd2657f6869f45c 2026-10-29T22:15:44.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-4f1678c5fcc8f215 2026-10-29T22:16:24.000Z weekly 0.7 https://radar.offseq.com/threat/jiratui-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-lines-f5e5bebb59c16870 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/jiratui-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-fcdecb499eb6687a 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/jiratui-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-arbitrary-2c0f3caf3f464abb 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-fee9553a997d2fea 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-9288f582580e45ba 2026-10-29T22:16:24.000Z weekly 0.7 https://radar.offseq.com/threat/jiratui-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-a84c95d2fb47fc95 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/mistune-path-traversal-and-xss-in-include-directive-cve-2026-115355-9ca173bd6743cfbd 2026-10-29T22:16:24.000Z weekly 0.7 https://radar.offseq.com/threat/pydantic-settings-nestedsecretssettingssource-follows-symlinks-outside-secretsdir-enabling-local-file-08303bd9f4fcd4ef 2026-10-29T22:16:24.000Z weekly 0.7 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-752d71e209bf6f6b 2026-10-29T22:16:24.000Z weekly 0.8 https://radar.offseq.com/threat/kaskade-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-0d11d2c721b1cb21 2026-10-29T22:17:22.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-d31b7ef1a699546b 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/kaskade-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-cve-bdd56edd96dca138 2026-10-29T22:17:22.000Z weekly 0.8 https://radar.offseq.com/threat/kaskade-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-cve-2026-691988f97ecd704e 2026-10-29T22:17:22.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-6b4d8a636cf9d7a8 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-b1f2c01d4783799c 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-f24e7b0065f9fe1f 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-dae30b07906f039c 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-f656475cbdaf30ae 2026-10-29T22:17:22.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-84d5731f0aa7fb46 2026-10-29T22:17:22.000Z weekly 0.9 https://radar.offseq.com/threat/setuptools-windows-path-escape-via-namespacepackagestxt-during-legacy-wheel-installation-description-529e442aae318777 2026-10-29T22:17:22.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-vulnerable-to-reflected-xss-in-clients-callback-page-cve-2025-62800-a9db395e68cddabb 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-vulnerable-to-windows-command-injection-in-fastmcp-cursor-installer-via-ccfe9101dbb27501 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-has-a-command-injection-vulnerability-gemini-cli-cve-2025-64340-66c010b74a83e5cb 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-oauth-proxy-token-reuse-across-mcp-servers-cve-2025-69196-a7d8ede316d748d3 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-atlassian-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-b3d8813513595c83 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-issecuretransport-loopback-exemption-can-be-bypassed-with-a-userinfo-component-allowing-f18f56e3f9437d0e 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-authlib-incomplete-algorithm-confusion-fix-permits-hmac-forgery-with-prefixed-public-keys-4a457baf68293cc2 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-atlassian-authlib-accepts-an-empty-hmac-key-allowing-jwsjwt-signature-forgery-hs256hs384hs512-bde6312ea31604bc 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-id-token-can-disable-its-own-nonce-validation-via-the-noncesupported-claim-cve-2026-114617-1c4ee327327cc0ad 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-default-jwt-bearer-grant-accepts-assertions-for-the-wrong-audience-cve-2026-114618-1ce5ae59937de80d 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-openid-implicit-grant-checks-raw-scope-instead-of-allowed-scope-before-issuing-id-tokens-cve-a7c0a83168628e25 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/authlib-unvalidated-requesturi-fetch-in-jwt-secured-authorization-request-jar-leading-to-ssrf-cve-2026-1f3d889962912dfb 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-ccd709726e403302 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-5e04da51bd2aa429 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/fastmcp-missing-consent-verification-in-oauth-proxy-callback-facilitates-confused-deputy-28bd83f39ed724cb 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-jws-jwk-header-injection-signature-verification-bypass-cve-2026-27962-637de2fc5dab3073 2026-10-29T22:18:19.000Z weekly 0.9 https://radar.offseq.com/threat/mcp-atlassian-authlib-vulnerable-to-jwe-rsa15-bleichenbacher-padding-oracle-cve-2026-28490-6a5d22ea5b2995f7 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-fail-open-cryptographic-verification-in-oidc-hash-binding-cve-2026-28498-6010d2a5ad8a9f62 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-setting-alg-none-and-a-blank-signature-appears-to-bypass-signature-verification-cve-2026-28802-68114524c3dcbcbb 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-openapi-provider-has-an-ssrf-path-traversal-vulnerability-cve-2026-32871-06df377aa0c97903 2026-10-29T22:18:19.000Z weekly 0.9 https://radar.offseq.com/threat/authlib-cross-site-request-forging-when-using-cache-cve-2026-41425-30b3b727e6c88c2c 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-authlib-oauth-20-has-open-redirect-in-authorization-api-that-allows-attacker-controlled-7a6ed8ef62527d8e 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-authlib-oidc-implicithybrid-authorization-vulnerable-to-open-redirect-cve-2026-44681-a88dca2f6e72eb9c 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-b64false-rfc7797-jws-payloads-bypass-jwsregistry-payload-size-limits-during-deserialization-15b23bcda4fbe257 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/joserfc-hs256hs384hs512-verify-accepts-emptynil-hmac-key-cross-language-sibling-of-cve-2026-45363-cve-e348a88a6875ddb9 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/authlib-empty-signatures-validation-in-jws-json-deserialization-cve-2026-96760-e0edd52167695dd1 2026-10-29T22:18:19.000Z weekly 0.9 https://radar.offseq.com/threat/fastmcp-post-transform-component-authorization-is-skipped-on-direct-calls-be72d222e06d2259 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-auth-integration-allows-for-confused-deputy-account-takeover-6549bca713a78e3d 2026-10-29T22:18:19.000Z weekly 0.8 https://radar.offseq.com/threat/mcp-atlassian-fastmcp-updated-to-mcp-123-due-to-cve-2025-66416-76430e49326328d0 2026-10-29T22:18:19.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-7475169c2e3e11f5 2026-10-29T22:18:51.000Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-0503468cfd75c3e6 2026-10-29T22:18:51.000Z weekly 0.7 https://radar.offseq.com/threat/pyjwt-hs256384512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwkpyjwkclient-enabling-token-forgery-efdaf8d52477fbf3 2026-10-29T22:18:51.000Z weekly 0.8 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-586e3ac35979c481 2026-10-29T22:18:52.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-virtualenv-allows-command-injection-through-activation-scripts-for-a-virtual-environment-cve-300f51770e40cebb 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-h11-accepts-some-malformed-chunked-encoding-bodies-cve-2025-43859-dd67467cd8cb00bd 2026-10-29T22:19:24.000Z weekly 0.9 https://radar.offseq.com/threat/poetry-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-cve-fa70a03342d47915 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/poetry-virtualenv-bash-and-fish-activation-scripts-execute-commands-embedded-in-paths-cve-2026-102925-b3e87b4751a204f2 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-downloaded-seed-wheels-pipsetuptools-are-not-integrity-checked-before-use-cve-2026-102930-f03ad71339c83c25 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-virtualenv-writes-prompt-values-into-pyvenvcfg-without-sanitizing-line-boundaries-allowing-1d5e79ad443d90af 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-998bce17245ec778 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-7e159bde116754f2 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-349bb2781433ae51 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-0947057a7febf198 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-4935624406130b9d 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-5520960fa11c81f6 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-c7ede0cb9353effc 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-3c67b90c3a3ca862 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-9a08efd0a06ae1e3 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-dbbb3da357a0f0de 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-0cdd6191e9619c54 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-builtin-creation-follows-linked-environment-directories-cve-2026-113716-66faece9e426d07e 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-seeded-files-retain-permissions-from-an-older-cache-cve-2026-113720-b73102be1ba243de 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-files-can-follow-existing-destination-links-cve-2026-113721-b76208798bd790d2 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-generated-posix-console-launchers-interpret-destination-paths-as-shell-syntax-cve-2026-71426579d339a553 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-prompt-values-can-change-meaning-under-older-compatibility-modes-cve-2026-113723-c9a811df2f6bc117 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-cve-2026-113724-660a8348fc89b2e1 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/poetry-virtualenv-bash-activate-runs-commands-from-an-environment-name-with-a-backslash-before-cve-5fd2c3824133b3a5 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-virtualenv-activate-runs-commands-from-the-environment-name-in-zsh-with-promptsubst-cve-2026-a4d9097dcedac272 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-virtualenv-activatefish-runs-commands-from-a-path-or-prompt-with-a-backslash-before-a-quote-cve-40ee5491704a6379 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/poetry-virtualenv-activation-scripts-run-code-from-a-path-that-contains-a-placeholder-name-cve-2026-bdea13c4b4951ec0 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/messagepack-unbounded-memory-leak-in-msgpack-c-extension-on-strictmapkey-validation-failure-cve-2026-981c587b69c0cd52 2026-10-29T22:19:24.000Z weekly 0.8 https://radar.offseq.com/threat/virtualenv-bash-activator-leaves-the-prompt-value-unescaped-in-ps1-when-promptvars-is-off-so-prompt-e87a1fa70d3d3503 2026-10-30T08:16:38.052Z weekly 0.8 https://radar.offseq.com/threat/poetry-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-a6e470cba7070178 2026-10-29T22:19:24.000Z weekly 0.7 https://radar.offseq.com/threat/poetry-virtualenv-has-toctou-vulnerabilities-in-directory-creation-cve-2026-22702-6e9b2c97c985d821 2026-10-30T08:17:12.538Z weekly 0.7 https://radar.offseq.com/threat/poetry-dulwich-has-an-arbitrary-file-write-via-ntfs-hostile-tree-entries-on-windows-cve-2026-42305-aa60a7d482637198 2026-10-30T08:16:34.237Z weekly 0.8 https://radar.offseq.com/threat/poetry-dulwich-vulnerable-to-command-injection-via-merge-driver-path-cve-2026-42563-3edacf2995a35f66 2026-10-30T08:16:29.794Z weekly 0.8 https://radar.offseq.com/threat/poetry-dulwich-doesnt-sanitize-commit-subjects-in-porcelainformatpatch-cve-2026-47712-daa220a2a0fe4d4d 2026-10-30T08:17:08.705Z weekly 0.7 https://radar.offseq.com/threat/poetry-dulwich-has-unbounded-memory-allocation-in-receive-pack-from-crafted-thin-packs-cve-2026-47734-d5d5c29cd1d05907 2026-10-30T08:17:04.623Z weekly 0.7 https://radar.offseq.com/threat/poetry-dulwichs-submodule-path-traversal-in-porcelainsubmoduleupdate-9e0b1d8d451562e2 2026-10-30T08:16:24.716Z weekly 0.8 https://radar.offseq.com/threat/mcp-atlassian-starlette-vulnerable-to-on2-dos-via-range-header-merging-in-862a19c0be689b91 2026-10-30T08:16:20.361Z weekly 0.8 https://radar.offseq.com/threat/opentelemetry-python-unbounded-tracestate-parsing-in-opentelemetry-api-cve-2026-114603-3a5e65ba88e6c4b2 2026-10-30T08:17:00.541Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-regression-in-pymdownxsnippets-reintroduces-sibling-prefix-path-traversal-bypass-despite-6be267cf33ca3a7c 2026-10-30T08:16:56.294Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-starlette-has-missing-host-header-validation-that-poisons-requesturlpath-bypassing-path-dbbdddda2af74e27 2026-10-30T08:16:51.756Z weekly 0.7 https://radar.offseq.com/threat/starlette-arbitrary-http-method-dispatched-to-httpendpoint-attributes-via-getattr-cve-2026-48817-d386cdccf7298662 2026-10-30T08:16:46.467Z weekly 0.7 https://radar.offseq.com/threat/mcp-atlassian-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-3e2b572bbdc54f23 2026-10-30T08:16:16.583Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-c7659fa172fa6896 2026-10-30T08:16:11.985Z weekly 0.8 https://radar.offseq.com/threat/starlette-unvalidated-request-path-concatenated-into-authority-poisons-requesturlhostname-cve-2026-466cc4926f07d0fd 2026-10-30T08:16:42.447Z weekly 0.7 https://radar.offseq.com/threat/starlette-requestform-limits-silently-ignored-for-applicationx-www-form-urlencoded-enable-dos-cve-2026-7b3dbe9b566b2016 2026-10-30T08:16:02.977Z weekly 0.8 https://radar.offseq.com/threat/pydantic-settings-nestedsecretssettingssource-follows-symlinks-outside-secretsdir-enabling-local-file-0fb867a1fff73a50 2026-10-30T08:15:58.195Z weekly 0.7 https://radar.offseq.com/threat/pymdown-extensions-path-traversal-in-the-b64-extension-lets-img-src-read-files-outside-basepath-cve-8828b7cc97a38a2e 2026-10-30T08:15:53.857Z weekly 0.7 https://radar.offseq.com/threat/pymdown-extensions-exponential-backtracking-redos-in-caret-tilde-betterem-and-magiclink-inline-4ed3b2ca7e0d8751 2026-10-30T08:15:48.844Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-87e52b5a7395bb20 2026-10-30T08:15:44.586Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-f6318132d5a77f09 2026-10-30T08:15:40.330Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-98a6a259d17d0879 2026-10-30T08:15:35.880Z weekly 0.7 https://radar.offseq.com/threat/nx-path-traversal-in-nx-migrate-package-migrations-extraction-cve-2026-104853-beddebc9a8792bd7 2026-10-30T08:15:31.191Z weekly 0.7 https://radar.offseq.com/threat/nx-daemon-and-plugin-worker-sockets-are-accessible-to-other-local-users-cve-2026-104854-dca2bc72779a134c 2026-10-30T08:15:25.867Z weekly 0.8 https://radar.offseq.com/threat/nx-graph-dev-server-permissive-cors-policy-cve-2026-54753-3fc0ae3df9d885d9 2026-10-30T08:15:21.438Z weekly 0.7 https://radar.offseq.com/threat/nx-zip-slip-in-the-self-hosted-remote-cache-cve-2026-71476-fd5ef9ea3f70a662 2026-10-30T08:15:16.922Z weekly 0.8 https://radar.offseq.com/threat/nx-os-command-injection-via-git-revisions-and-remote-refs-51ed48f30a8c07e4 2026-10-30T08:14:39.188Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-submodule-update-path-traversal-can-write-outside-the-repository-cve-2026-100689-b8bbf54958a99838 2026-10-30T08:15:12.701Z weekly 0.7 https://radar.offseq.com/threat/gitpython-separategitdir-leaks-env-vars-via-crafted-gitmodules-submodule-name-cve-2026-110855-d6d9a49d43f0e813 2026-10-30T08:15:08.259Z weekly 0.7 https://radar.offseq.com/threat/mistral-vibe-gitpython-parseactoranddate-is-vulnerable-to-quadratic-backtracking-on-malformed-identity-e764d673066ce34d 2026-10-30T08:14:35.204Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-command-wrappers-omit-unsafe-protocol-and-option-checks-cve-2026-110857-9733cf6b73edb139 2026-10-30T08:14:31.248Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-remotepull-refspec-bypasses-the-upload-pack-unsafe-option-guard-enabling-fa079f6ae686af53 2026-10-30T08:14:27.261Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-attacker-controlled-branch-name-in-headcheckout-incomplete-fix-of-b95b285a441e6477 2026-10-30T08:14:23.242Z weekly 0.8 https://radar.offseq.com/threat/gitpython-submodulemove-follows-an-attacker-committed-intermediate-symlink-outside-the-worktree-cve-f166033b727e76ab 2026-10-30T08:15:04.096Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-validates-a-submodules-git-path-only-after-cloning-into-it-rce-cve-2026-114145-fc1c1b7dbfbd5882 2026-10-30T08:14:18.234Z weekly 0.8 https://radar.offseq.com/threat/opentelemetry-python-unbounded-tracestate-parsing-in-opentelemetry-api-cve-2026-114603-3e3196b750872f44 2026-10-30T08:14:59.719Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-http-client-transports-followed-cross-origin-redirects-carrying-8c0d7a4b70faa484 2026-10-30T08:14:48.715Z weekly 0.7 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-990bb04cf1da0f78 2026-10-30T08:14:42.971Z weekly 0.7 https://radar.offseq.com/threat/mistral-vibe-gitpython-has-command-injection-via-git-options-bypass-cve-2026-42215-76191566c2e40834 2026-10-30T08:14:12.883Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-option-check-validates-multioptions-before-shlexsplit-transformation-cve-2026-42284-fde9f05242d380c3 2026-10-30T08:14:09.243Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-reference-apis-has-a-path-traversal-vulnerability-that-allows-arbitrary-file-c19bdc74cd73010e 2026-10-30T08:03:15.612Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwritersetvalue-enables-rce-via-corehookspath-cve-2026-44244-cc93cab95cb3fde8 2026-10-30T08:03:10.483Z weekly 0.8 https://radar.offseq.com/threat/mcp-python-sdk-http-transports-serve-session-requests-without-verifying-the-authenticated-principal-e7ba4411d2ea858c 2026-10-30T08:03:05.395Z weekly 0.8 https://radar.offseq.com/threat/mcp-python-sdk-experimental-task-handlers-allow-any-client-to-access-and-cancel-other-clients-tasks-fd0987376b9b819b 2026-10-30T08:01:58.743Z weekly 0.8 https://radar.offseq.com/threat/mcp-python-sdk-websocket-server-transport-does-not-support-hostorigin-validation-cve-2026-59950-f515021280a434e9 2026-10-30T08:01:54.515Z weekly 0.8 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-ospathexpandvars-on-repoclonefrom-url-cve-2026-67322-0a0cbd16a8e20249 2026-10-30T08:01:49.582Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-unguarded-git-options-in-repoarchive-gitlsremote-and-arbitrary-file-3ccdfda7fd05b794 2026-10-30T08:01:44.995Z weekly 0.8 https://radar.offseq.com/threat/mistral-vibe-gitpython-unsafe-clone-option-gate-bypass-through-joined-short-options-cve-2026-67324-ac801c1bc208d375 2026-10-30T08:01:40.804Z weekly 0.8 https://radar.offseq.com/threat/gitpython-command-injection-via-git-long-option-prefix-abbreviation-bypass-of-cve-2026-42215-blocklist-d325cb1ef3d96429 2026-10-30T08:01:36.336Z weekly 0.8 https://radar.offseq.com/threat/gitpython-newline-injection-in-configwriter-section-parameter-bypasses-cve-2026-42215-patch-enabling-d1c352f027beb8d6 2026-10-30T08:01:30.837Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-section-name-injection-enables-arbitrary-config-directives-coresshcommand-rce-cve-135faac356e52efe 2026-10-30T08:01:26.315Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitarchiveoptions-denylist-omits-add-file-add-virtual-file-enabling-a178f1cb77f76097 2026-10-30T08:03:01.559Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-indexfilecheckout-and-tagreferencecreate-enables-161b6950265a0d31 2026-10-30T07:59:45.001Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-truncation-via-git-rev-list-output-argument-injection-in-unguarded-commitcount-7d2e1ee655caf81e 2026-10-30T08:02:57.144Z weekly 0.7 https://radar.offseq.com/threat/gitpython-environment-variable-exfiltration-via-repocreateremote-remoteadd-url-incomplete-fix-of-7b88c80e7899bf67 2026-10-30T07:59:40.664Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitcloneoptions-denylist-omits-template-enabling-arbitrary-command-d8d326d47962436f 2026-10-30T07:45:46.106Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-overwrite-via-git-diff-output-argument-injection-in-diffablediff-key-and-7ebec13ecc17a271 2026-10-30T07:45:42.120Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-single-character-kwarg-value-token-smuggling-enables-504285daa142f443 2026-10-30T07:45:38.322Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-file-read-via-pathspec-from-file-in-indexfileremove-and-headcheckout-cve-2026-76217-dbed16cbe7e4bc1f 2026-10-30T07:45:34.247Z weekly 0.7 https://radar.offseq.com/threat/gitpython-unguarded-git-option-forwarding-in-repoinit-enables-arbitrary-command-execution-via-template-4588247f1378a1f6 2026-10-30T07:45:29.934Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unguarded-git-read-tree-option-forwarding-in-indexfilefromtreeresetmergetree-enables-be6f1daa046c7936 2026-10-30T07:45:26.065Z weekly 0.8 https://radar.offseq.com/threat/gitpython-unsafe-git-option-guard-bypass-via-splitsinglecharoptionsfalse-short-option-token-smuggling-a6104b881fb789f0 2026-10-30T07:45:21.384Z weekly 0.8 https://radar.offseq.com/threat/gitpython-git-config-option-name-injection-via-whitespace-bypasses-name-validator-enabling-forged-f8ed119a6a9e6391 2026-10-30T07:44:39.924Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-git-repository-creation-outside-the-working-tree-via-unvalidated-gitmodules-6ca767b378365bed 2026-10-30T07:44:35.870Z weekly 0.8 https://radar.offseq.com/threat/gitpython-arbitrary-local-file-content-disclosure-via-include-directive-in-untrusted-gitmodules-08835f3b56ed9a71 2026-10-30T07:44:31.953Z weekly 0.8 https://radar.offseq.com/threat/gitpython-dormant-multi-line-git-config-values-are-corrupted-into-live-injected-directives-eg-cve-2026-679864ef9dd9bb34 2026-10-30T07:44:26.982Z weekly 0.9 https://radar.offseq.com/threat/gitpython-clonefromclone-omit-separate-git-dir-from-unsafegitcloneoptions-enabling-arbitrary-aaff068ffea7d2a0 2026-10-30T07:44:23.081Z weekly 0.8 https://radar.offseq.com/threat/gitpython-incomplete-unsafegitrevisionoptions-denylist-omits-contents-s-enabling-arbitrary-file-read-9d3f0d5ebf9388f3 2026-10-30T07:45:17.625Z weekly 0.7 https://radar.offseq.com/threat/gitpython-tagreferencecreate-positional-reference-bypasses-kwargs-only-file-guard-enabling-arbitrary-0b8f6605a1415c40 2026-10-30T07:45:13.504Z weekly 0.7 https://radar.offseq.com/threat/gitpython-denial-of-service-via-catastrophic-backtracking-redos-in-actornameemailregex-commit-0d643374a2c49424 2026-10-30T07:44:17.414Z weekly 0.8 https://radar.offseq.com/threat/pyjwt-hs256384512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwkpyjwkclient-enabling-token-forgery-a4d1bfdbbe42f674 2026-10-30T07:44:12.932Z weekly 0.8 https://radar.offseq.com/threat/model-context-protocol-python-sdk-client-fetched-server-chosen-ref-urls-while-validating-tool-results-fe4e62cc8296130d 2026-10-30T07:45:09.496Z weekly 0.7 https://radar.offseq.com/threat/lexicon-requests-vulnerable-to-netrc-credentials-leak-via-malicious-urls-cve-2024-47081-f9a2313413dc75a6 2026-10-30T07:45:04.524Z weekly 0.7 https://radar.offseq.com/threat/lexicon-filelock-has-a-toctou-race-condition-which-allows-symlink-attacks-during-lock-file-creation-1d2ae48eb9d02c88 2026-10-30T07:45:01.311Z weekly 0.7 https://radar.offseq.com/threat/multidict-reference-leak-in-cimultidictmultidict-items-view-union-and-subtraction-cve-2026-104874-775a83c8924ec7d1 2026-10-30T07:44:56.982Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-e3a2db83ed3c4b84 2026-10-30T07:44:53.023Z weekly 0.7 https://radar.offseq.com/threat/lexicon-aiohttp-server-lacks-an-initial-requestheader-timeout-cve-2026-111064-1882197facc042e3 2026-10-30T07:44:08.398Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-connector-pool-exhaustion-via-max-age-overflow-cve-2026-111065-78e7c13120d17711 2026-10-30T07:44:50.004Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-file-descriptor-exhaustion-in-multipart-requests-cve-2026-111066-83e9b1008f982ea3 2026-10-30T07:31:49.498Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-absolute-form-request-targets-can-spoof-requestscheme-cve-2026-111748-807e11e3168ca316 2026-10-30T07:44:46.897Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-cookie-from-subdomain-can-remove-host-only-scope-from-existing-cookies-cve-2026-111749-43db93c6fd72f60a 2026-10-30T07:44:43.351Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-pure-python-parser-request-smuggling-cve-2026-111750-16fcf2c75af1f0cd 2026-10-30T07:33:06.063Z weekly 0.7 https://radar.offseq.com/threat/filelock-on-windows-an-oplock-on-a-soft-locks-marker-holds-softfilelockacquire-past-its-timeout-and-11567c6510ad4f49 2026-10-30T07:33:03.141Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-creates-its-claim-directories-without-the-lock-mode-so-another-local-user-5e329fe44a238569 2026-10-30T07:32:58.832Z weekly 0.7 https://radar.offseq.com/threat/filelock-unixfilelock-truncates-and-chmods-any-regular-file-another-user-renames-or-hard-links-onto-3ba04d6498ed0f30 2026-10-30T07:32:54.881Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-and-softreadwritelock-adopt-a-protocol-directory-another-user-created-4e8fd6f6af15cc87 2026-10-30T07:32:50.513Z weekly 0.7 https://radar.offseq.com/threat/filelock-symlink-swap-during-softfilelocks-writability-check-leaks-whether-a-path-exists-and-is-241b38a3dffe8d92 2026-10-30T07:32:45.705Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-on-windows-acts-on-sqlite-side-files-another-local-user-places-beside-its-20dbd110034dbf1f 2026-10-30T07:32:40.181Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-a-crafted-lock-database-makes-every-acquire-stall-or-hang-regardless-of-timeout-d9abbd759159ee1b 2026-10-30T07:32:35.035Z weekly 0.7 https://radar.offseq.com/threat/filelock-softreadwritelock-holder-refresh-writes-through-a-hard-link-and-hangs-on-a-named-pipe-that-2e2a83ce085d99aa 2026-10-30T07:32:30.176Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-stale-lock-break-removes-a-live-lock-file-on-a-reused-inode-number-and-admits-2f5f80db90b2c217 2026-10-30T07:32:25.388Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-follows-a-symlink-at-the-lock-path-into-sqlite-cve-2026-112936-00afb5f407825217 2026-10-30T07:32:21.042Z weekly 0.7 https://radar.offseq.com/threat/filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in-at-pathfilelock-and-creates-claim-files-9a0756db91d5efd9 2026-10-30T07:32:16.660Z weekly 0.7 https://radar.offseq.com/threat/filelock-softfilelock-removes-a-live-holders-marker-when-another-user-forges-the-pid-in-a-writable-fed96543f60d94a4 2026-10-30T07:32:11.838Z weekly 0.7 https://radar.offseq.com/threat/filelock-readwritelock-sqlite-reopens-the-lock-database-by-name-so-a-planted-symlink-or-journal-file-f2b9c657a3cd6737 2026-10-30T07:31:46.288Z weekly 0.8 https://radar.offseq.com/threat/lexicon-dnspython-dnsnamefromwireparser-excessive-cpu-use-cve-2026-114605-a0fd4c7272157089 2026-10-30T07:31:41.207Z weekly 0.8 https://radar.offseq.com/threat/lexicon-filelock-time-of-check-time-of-use-toctou-symlink-vulnerability-in-softfilelock-cve-2026-22701-dd0173baac949ed7 2026-10-30T07:32:06.291Z weekly 0.7 https://radar.offseq.com/threat/lexicon-soup-sieve-has-memory-exhaustion-via-large-comma-separated-selector-lists-cve-2026-49476-ca424ba7d8f47135 2026-10-30T07:31:38.210Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-regular-expression-denial-of-service-redos-via-selector-parser-cve-2026-49477-c8d5c7d85fde4141 2026-10-30T07:31:34.471Z weekly 0.8 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-whitespacecomment-trimming-regex-rewsend-triggers-on-valid-0133ace467c48433 2026-10-30T07:32:00.826Z weekly 0.7 https://radar.offseq.com/threat/soup-sieve-polynomial-time-redos-on-in-the-identifier-value-selector-sub-patterns-cve-2026-86000-257cdb585d6d473d 2026-10-30T07:31:56.680Z weekly 0.7 https://radar.offseq.com/threat/aiohttp-multiple-instances-of-excessive-or-unbounded-memorycpu-use-53872e821b99e64b 2026-10-30T07:31:29.770Z weekly 0.8 https://radar.offseq.com/threat/aiohttp-secure-attribute-not-enforced-for-shared-cookie-cve-2026-111063-9cb2023db2e19bef 2026-10-30T07:31:52.532Z weekly 0.7 https://radar.offseq.com/threat/posting-scrapy-is-vulnerable-to-a-denial-of-service-dos-attack-due-to-flaws-in-brotli-decompression-acfd94cd090564b6 2026-10-30T07:31:26.742Z weekly 0.8 https://radar.offseq.com/threat/gitpython-repository-content-can-impersonate-the-git-directory-leading-to-arbitrary-code-execution-cve-60f510dec0e06568 2026-10-30T07:31:23.386Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-68f93afd2ca2b9ad 2026-10-30T08:02:52.773Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-8f583ed89af36de2 2026-10-30T07:59:36.511Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-038778f602368411 2026-10-30T07:59:30.586Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-cbc8ce64e271f853 2026-10-30T08:02:47.182Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-5ce551d435526495 2026-10-30T08:02:42.369Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-a428acdf1b34339c 2026-10-30T08:02:37.512Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-5735d440a66e2334 2026-10-30T08:02:33.092Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-16d32dc792797c4e 2026-10-30T08:02:28.339Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-4cac9ffb2b724226 2026-10-30T08:02:23.570Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-curl-security-update-247986628ebad6bd 2026-10-30T08:02:18.050Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-e54db4e3f6af93b4 2026-10-30T07:59:24.062Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-556a1e4e8f729c3a 2026-10-30T07:59:19.255Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-1c651595238ab711 2026-10-30T07:59:14.272Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-9e56ec95ee168686 2026-10-30T07:59:10.314Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-47a4386819fb7fbf 2026-10-30T07:50:59.091Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-27ec3efd0f17d66e 2026-10-30T07:50:54.774Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-8f91f28e7869faff 2026-10-30T07:50:48.694Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-317a0ad8d36eebcb 2026-10-30T07:50:42.498Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-11524843c02c36f5 2026-10-30T07:50:37.912Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-f617d730911732c5 2026-10-30T08:00:54.274Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-8099eb6f4a4900f8 2026-10-30T08:00:48.317Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-bece8ecbc428db00 2026-10-30T07:50:31.578Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-89f917b870ad4a02 2026-10-30T08:00:41.393Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-e65afc813aa6a7c7 2026-10-30T08:00:34.049Z weekly 0.7 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-security-update-b76ee9b9a91f4997 2026-10-30T07:50:24.831Z weekly 0.8 https://radar.offseq.com/threat/red-hat-security-advisory-red-hat-hardened-images-rpms-bug-fix-and-enhancement-update-98aa1c604b856843 2026-10-30T07:50:18.817Z weekly 0.8 https://radar.offseq.com/threat/rsyslog-dynfile-path-traversal-arbitrary-file-write-as-root-rce-67f3f99e4d2f4cb0 2026-10-30T08:00:27.482Z weekly 0.8 https://radar.offseq.com/threat/org-server-present-extension-use-after-free-1e0a59e471c05e91 2026-10-30T08:00:24.470Z weekly 0.7 https://radar.offseq.com/threat/org-server-xinput-passive-grab-use-after-free-023d3bc71bb68b77 2026-10-30T08:00:21.167Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-glx-renderlarge-heap-buffer-overflow-cf9685d70dc64c36 2026-10-30T08:00:18.074Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-xkb-resizekeytype-numeric-truncation-bd972cc0c6c56262 2026-10-30T08:00:14.919Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-xfixes-pointer-barrier-event-list-buffer-overflow-b8e1f06b7359f10e 2026-10-30T08:00:11.482Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-xkb-changekeycoderange-heap-out-of-bounds-write-4d566ef3b8b423a6 2026-10-30T08:00:08.417Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-randr-changeproviderproperty-heap-buffer-overflow-ee156fe4872d2f00 2026-10-30T08:00:05.228Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-xinput2-passiveungrabdevice-out-of-bounds-write-61c008a5b6e38cc6 2026-10-30T08:00:00.808Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-xkb-setmap-key-widthaction-count-desync-out-of-bounds-read-2ce993b391d9e606 2026-10-30T07:59:57.540Z weekly 0.7 https://radar.offseq.com/threat/xorg-server-gesturebuildsprite-use-after-free-f618a1e0fbaa9d42 2026-10-30T07:59:54.607Z weekly 0.7 https://radar.offseq.com/threat/amplified-resource-exhaustion-in-inbound-message-processing-227560221de4dbf3 2026-10-30T07:59:51.357Z weekly 0.7 https://radar.offseq.com/threat/concurrent-gss-tsig-messages-corrupt-memory-f1914a72758550b9 2026-10-30T07:59:48.567Z weekly 0.7 https://radar.offseq.com/threat/named-may-terminate-unexpectedly-when-a-redirect-zone-is-used-with-strict-qname-minimization-5f0797277cf42756 2026-10-30T07:51:52.663Z weekly 0.7 https://radar.offseq.com/threat/specific-rpz-configurations-and-query-patterns-may-result-in-an-unexpected-exit-00317a9e53c6e871 2026-10-30T07:51:49.834Z weekly 0.7 https://radar.offseq.com/threat/virtualenv-deletion-recovery-can-change-a-symlink-targets-mode-9c0cd89a315f3709 2026-10-30T07:51:46.691Z weekly 0.7 https://radar.offseq.com/threat/libxrender-renderquerypictformats-reply-heap-based-buffer-overflow-71808711b7f0278e 2026-10-30T07:51:43.730Z weekly 0.7 https://radar.offseq.com/threat/race-condition-in-tempfiletemporarydirectory-cleanup-allows-deleting-files-outside-the-temporary-6af1e674943971ab 2026-10-30T07:51:40.469Z weekly 0.8 https://radar.offseq.com/threat/mm-call-the-securitymmapfile-lsm-hook-in-remapfilepages-5f85e752af0ba2a1 2026-10-30T07:51:37.432Z weekly 0.7 https://radar.offseq.com/threat/in-libexpat-through-273-a-crafted-file-with-an-approximate-size-of-2-mib-can-lead-to-dozens-of-seconds-fa3bcbc4ce7dd197 2026-10-30T07:51:33.724Z weekly 0.7 https://radar.offseq.com/threat/kvm-x86mmu-dropzap-existing-present-spte-even-when-creating-an-mmio-spte-50b3bf2fe4cbafaa 2026-10-30T07:51:30.603Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-memory-leak-in-verifyheader-311ec82c737e4435 2026-10-30T07:51:27.929Z weekly 0.7 https://radar.offseq.com/threat/apparmor-replace-recursive-profile-removal-with-iterative-approach-14a29f37daa7e6b7 2026-10-30T07:51:25.250Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-limit-the-number-of-levels-of-policy-namespaces-97426e40b9285dd1 2026-10-30T07:51:22.641Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-side-effect-bug-in-matchchar-macro-usage-2961bb12e885dcf2 2026-10-30T07:51:19.618Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-missing-bounds-check-on-default-table-in-verifydfa-575b2cbc383fa256 2026-10-30T07:51:16.438Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-double-free-of-nsname-in-aareplaceprofiles-d60ab72871b433db 2026-10-30T07:51:12.803Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-differential-encoding-verification-9c71577f5d72bd7f 2026-10-30T07:51:08.858Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-race-on-rawdata-dereference-16013c92a90c1f3a 2026-10-30T07:51:05.839Z weekly 0.7 https://radar.offseq.com/threat/apparmor-fix-race-between-freeing-data-and-fs-accessing-it-0464430e432c82c9 2026-10-30T07:51:02.784Z weekly 0.7 https://radar.offseq.com/threat/malicious-code-in-claims-acct-unlock-npm-28568743f9f8ab2e 2026-10-30T08:02:13.958Z weekly 0.7 https://radar.offseq.com/threat/get-iplayer-mojolicious-versions-from-728-through-945-for-perl-will-generate-weak-hmac-session-cookie-f2facdb9bb779739 2026-10-30T08:02:02.491Z weekly 0.7 https://radar.offseq.com/threat/cve-2026-82104-cwe863-incorrect-authorization-in-teltonika-networks-rut-fa6ae78ef5328d8c 2026-10-30T08:16:06.989Z weekly 0.9