The PyPI package 'queeuees' version 0.0.1 contains obfuscated malicious code that executes at import time. The package ships two similarly named top-level packages with identical payloads that decode and execute hidden code via complex byte transformations. This code modifies the system by iterating over Python files and adding comments without user consent. The package metadata misleads users by advertising itself as a basic calculator. The obfuscation and unauthorized system modifications indicate clear malicious intent.
CVE-2026-94286 is an out-of-bounds read vulnerability in libXtst's RECORD reply parser that could be exploited by malicious X servers to crash attached X clients. It affects multiple versions of libXtst prior to 1.2.6. The vulnerability has a CVSS score of 7.1, indicating medium severity, with impact primarily on availability due to potential crashes. No specific patch information is provided in the input data.
A low-severity security update for GIMP addresses a one-byte out-of-bounds heap read vulnerability in the uncompressed DDS image loader (CVE-2026-96546) and an out-of-bounds write in the GIMPressionist plugin (CVE-2026-97185). Both vulnerabilities could lead to memory corruption but have a low impact and no confirmed exploits in the wild. Multiple specific GIMP versions are affected, primarily in the 2.8.x, 2.10.x, and 3.x series. No patch details are provided in the available data.
A vulnerability in SSSD occurs when configured with the LDAP access provider and ldap_access_order including ppolicy or lockout. If a user lookup returns zero results, a fail-open condition in the LDAP ppolicy access check can cause an incorrect success response and cache an allow decision. This permits continued authorization for deleted or deprovisioned users. A remote attacker with prior valid account context could exploit this to maintain access and potentially make limited modifications to resources no longer authorized.
A vulnerability in the sssd NSS responder allows a local attacker to cause an out-of-bounds read by sending specially crafted service lookup requests to the NSS responder's UNIX socket. This can cause the NSS responder process to crash, resulting in a denial of service (DoS). There is no evidence that this issue leads to privilege escalation or data disclosure. Multiple specific versions of sssd are affected.
A vulnerability in sssd's PAM responder protocol v1 parser (pam_parse_in_data()) allows a local client with access to the PAM responder's UNIX socket to cause an out-of-bounds read by sending an empty or truncated PAM request body. This can cause the PAM responder to terminate or restart, resulting in a local denial of service. The issue affects multiple specific versions of sssd. The CVSS score is 4.0, indicating medium severity.
A vulnerability in SSSD (System Security Services Daemon) allows a local attacker with privileges to connect to the PAM responder socket to cause a denial of service. This occurs when the pam_app_services configuration is enabled and a specially crafted request omits the service item, leading to a NULL pointer dereference and crashing the PAM responder, disrupting authentication services. The vulnerability has a medium severity with a CVSS score of 5.5. Multiple specific versions of SSSD are affected. No known exploits in the wild have been reported.
A vulnerability in sssd allows a local unprivileged user to send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder, causing a denial-of-service condition by making the NSS responder unstable or terminate. This affects system availability but does not impact confidentiality or integrity. The vulnerability has a medium severity with a CVSS score of 5.5.
A vulnerability in SSSD's IdP authentication provider allows an attacker to authenticate as another user if the attacker's IdP identifier is a strict prefix of the target user's identifier. This flaw is due to incorrect use of strncmp() in the eval_access_token_buf() function. The issue affects multiple specific versions of SSSD and has a CVSS score of 7.5, indicating medium severity.
PraisonAI versions up to 4.6.77 contain an authentication bypass vulnerability in the Call API agent invocation endpoints when the PRAISONAI_CALL_AUTH setting is disabled. The vulnerability arises because the localhost-only restriction is enforced by checking the HTTP Host header, which is client-controlled, allowing a remote attacker to spoof this header and bypass authentication to list and invoke agents.
PraisonAI versions up to 4.6.77 contain a vulnerability where deployment configuration values are not safely encoded when generating Python source code for API servers. This allows attackers to inject arbitrary Python expressions via specific configuration parameters, leading to code execution when the server starts or processes requests.
PraisonAI versions up to 4.6.77 contain a critical SQL injection vulnerability in the PGVector and Cassandra knowledge-store create_collection() backends. The vulnerability arises because the dimension argument, which should be an integer, is not validated at runtime and is directly interpolated into the CREATE TABLE DDL statement. This allows an attacker controlling the dimension parameter to inject arbitrary SQL or CQL commands, potentially leading to data compromise or destruction.
PraisonAI versions up to 4.6.77 contain a vulnerability where custom command templates do not properly validate file path references. This allows attackers to perform path traversal or use absolute paths to read files outside the intended workspace, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. The advisory is a duplicate and has been withdrawn in favor of another reference. No patch links are provided in this data.
PraisonAI versions up to 4.6.77 contain a path traversal vulnerability in the ContextGatherer component. This flaw allows attackers to supply absolute or parent directory traversal paths in .praisoncontext and .praisoninclude files, enabling reading of arbitrary files outside the intended workspace. The vulnerability has a medium severity rating with a CVSS score of 5.5.
PraisonAI versions up to 4.6.77 have a prompt injection defense vulnerability where the defense only blocks threats classified as CRITICAL, requiring three or more detector families to trigger simultaneously. This allows attackers to bypass the defense with single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked.
This is a security update for the SUSE product related to dotnet9.0, providing a functional equivalent of Red Hat advisory RHSA-2026:13282. The update addresses multiple CVEs including CVE-2026-26171 and others. No specific affected versions are stated. The severity is assessed as high. No CVSS score is provided. No known exploits in the wild are reported.
This is a security update for SUSE's dotnet8.0 product addressing the vulnerability identified as CVE-2026-26130. The update provides a functional equivalent to the Red Hat advisory RHSA-2026:10084. No specific affected versions or detailed technical information are provided in the input data.
This is a security update for SUSE related to dotnet9.0 that provides a functional equivalent of a Red Hat advisory RHSA-2026:10085. The update addresses vulnerabilities identified by CVE-2026-26127 and CVE-2026-26130. No specific affected versions are stated in the provided data. The severity is assessed as high. No CVSS score is available for these vulnerabilities.
A security update for GIMP addresses a vulnerability identified as CVE-2025-15059. This update is functionally equivalent to the Red Hat advisory RHSA-2026:2930. No specific affected versions or technical details are provided in the input data.