CubeCart v6 ecommerce software versions prior to 6.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the search feature. This occurs when a search returns exactly one product, causing user input to be reflected without proper sanitization due to a logic flaw. An unauthenticated attacker can exploit this to execute malicious JavaScript in a victim's browser. The vulnerability is fixed in version 6.7.0.
OpenClaw versions before 2026.4.23 have a vulnerability in the bundled plugin setup resolver that loads a JavaScript file from the current working directory without proper control. This allows an attacker to execute arbitrary JavaScript code under the current user account by placing a malicious setup-api.js file in a specific directory and tricking a user into running OpenClaw commands there.
SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.
`GitConfigParser.set_value()` passes values to Python's `configparser` without validating for newlines. GitPython's own `_write()` converts embedded newlines into indented continuation lines (e.g. `\n` becomes `\n\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path.
The vulnerability is not merely malformed config output: GitPython's own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration.
This was found while auditing MLRun's `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`.
PoC (standalone, no MLRun required):
```python
import git, subprocess, os
repo = git.Repo("/tmp/testrepo")
with repo.config_writer() as cw:
cw.set_value("user", "name", "foo\n[core]\nhooksPath=/tmp/hooks")
r = subprocess.run(["git", "config", "core.hooksPath"], cwd="/tmp/testrepo", capture_output=True, text=True)
assert r.returncode == 0
print(r.stdout.strip()) # /tmp/hooks
os.makedirs("/tmp/hooks", exist_ok=True)
open("/tmp/hooks/pre-commit", "w").write("#!/bin/sh\nid > /tmp/pwned\n")
os.chmod("/tmp/hooks/pre-commit", 0o755)
repo.index.add(["README"])
repo.git.commit(m="test")
print(open("/tmp/pwned").read()) # uid=...
```
Tested on GitPython 3.1.46, git 2.39+.
Impact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically.
Remediation: `set_value()` should raise on CR, LF, or NUL in values rather than silently pass them through:
```python
import re
if isinstance(value, (str, bytes)) and re.search(r"[\r\n\x00]", str(value)):
raise ValueError("Git config values must not contain CR, LF, or NUL")
```
Rejecting is safer than stripping — a stripped newline might indicate the caller is passing unsanitized input at a higher level, and silent normalization masks that.
Affected wherever `config_writer().set_value(section, key, user_input)` is called with external input.** GitPython is a dependency of DVC, MLflow, Kedro, and others — worth auditing their `set_value()` call sites for externally influenced inputs.
CVE-2026-40004 is a medium severity vulnerability in the ZTE ZXCLOUD iRAI client (version ZXCLOUD-iRAI-ClientV7.2X) involving an uncontrolled search path element related to openssl.cnf. This flaw allows a local attacker to execute arbitrary code and escalate privileges by exploiting the improper handling of the OpenSSL configuration file. The vulnerability requires local access and user interaction, with a high attack complexity and limited privileges initially. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.
A critical SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The flaw is in the FilterEngine.create_postgres_query() function when the postgres_meta metadata plugin is used. Authenticated users can exploit this via the DID search endpoint to execute arbitrary SQL commands on the PostgreSQL metadata database. This can lead to exposure or modification of sensitive data, file access, or even code execution depending on database privileges. The vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
CVE-2026-29080 is a critical SQL injection vulnerability in Rucio's FilterEngine.create_sqla_query() method affecting Oracle database deployments. Authenticated users can exploit this flaw via the DID search API to execute arbitrary SQL commands, potentially compromising the entire backend database including sensitive authentication tokens and data identifiers. The vulnerability affects Rucio versions from 1.27.0 up to but not including 35.8.5, 38.5.5, 39.4.2, and 40.1.1, where it has been fixed. PostgreSQL and MySQL deployments are not affected. The issue arises because attacker-controlled input is directly interpolated into raw SQL text without parameterization, enabling full database compromise.
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas
Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data
Affect Version:
This issue affects Apache Atlas: from 0.8 through 2.4.0.
For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration.atlas.dsl.executor.traversal=false
Mitigation:
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVE-2026-7211 is a command injection vulnerability in dvladimirov MCP version 0.1.0, specifically in the GitSearchRequest function of the mcp_server.py file within the Git Search API component. An attacker can remotely manipulate the repo_url or pattern argument to execute arbitrary commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although the issue was reported early, the project has not yet responded or provided a fix. Exploit code is publicly available, but no known exploits in the wild have been reported to date.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (0dd56777fc9c2f0f311af228a914590aef7129d64e7a38aa3e861ff22e37b40c)
## Source: ossf-package-analysis (2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c)
The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/crates.io/semantic_search_client/MAL-2026-3102.json))
## Source: ossf-package-analysis (2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c)
The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 (crates.io) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
Since February 2026, multiple incidents involving data theft and extortion have been attributed to activity cluster CL-CRI-1116, also known as BlackFile, UNC6671, and Cordial Spider. These financially-motivated attackers, likely associated with "The Com" collective, employ voice-based phishing combined with credential harvesting through fraudulent login pages. They impersonate IT support staff to steal credentials and bypass multi-factor authentication. The attackers focus on Living Off the Land techniques, abusing legitimate APIs like Microsoft Graph to access SharePoint sites and Salesforce data. They search for confidential information and employee data within SaaS environments, then exfiltrate it through browser downloads or API exports. To pressure victims into paying seven-figure ransoms, attackers send demands via Gmail and compromised email accounts, sometimes employing SWATting tactics against executives.
CVE-2026-29971 is a reflected cross-site scripting (XSS) vulnerability in WebFileSys versions prior to 2.32.0. The flaw occurs because user input is improperly encoded before being reflected in HTML and JavaScript contexts. This affects multiple components including ftpBackup functionality, authentication input handling, search functionality, and error message rendering. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim's browser. It has a CVSS score of 6.1, indicating medium severity. A fix was introduced in version 2.32.
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process to hang indefinitely. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
Prometheus versions prior to 3.5.2 and between 3.6.0 and 3.11.1 have stored cross-site scripting (XSS) vulnerabilities in their web UI. These arise from improper escaping of metric names and label values injected into innerHTML in UI components like chart tooltips and the Metric Explorer fuzzy search. An attacker who can inject metrics via compromised scrape targets or receivers may execute arbitrary JavaScript in users' browsers. This could lead to configuration exfiltration, data deletion, or service shutdown depending on enabled features. The vulnerabilities are fixed in versions 3.5.2 and 3.11.2. Mitigations include restricting exposure of remote write and OTLP receivers, trusting scrape targets, disabling admin or mutating API endpoints in untrusted environments, and avoiding untrusted links that generate poisoned labels.
Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be executed with the privilege of the user invoking EmoCheck.
MacSync Stealer is a macOS infostealer operating as Malware-as-a-Service (MaaS), distributed through SEO poisoning and fake ClickFix CAPTCHAs. The campaign has evolved through three iterations since November 2025, shifting from fake download sites to malicious ChatGPT conversations and finally to sophisticated shell-based loaders with dynamic AppleScript payloads. Threat actors use Google-sponsored search results to redirect victims to fake CAPTCHA pages that trick users into executing malicious terminal commands. The stealer targets browser credentials, cryptocurrency wallets, SSH keys, cloud provider credentials, and Keychain data. A critical capability includes trojanizing Ledger hardware wallet applications to capture seed phrases. The February 2026 campaign generated over 18,000 clicks in three days, with Russian-language comments suggesting operators work within a Russian-speaking ecosystem. The malware employs API key-gated C2 infrastructure and in-memory execution for evasion.
MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.
GLPI versions from 11.0.0 up to but not including 11.0.6 contain an unauthenticated time-based blind SQL injection vulnerability in the Search engine. This vulnerability allows an attacker to execute arbitrary SQL commands without authentication. The issue is fixed in version 11.0.6. The vulnerability has a high severity with a CVSS score of 8.
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.