The PyPI package 'fhqiouhq' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This package is identified as part of a typosquatting campaign targeting Telegram users, aiming to steal information.
The PyPI package 'ajfhiuqhfqgwerhuqnfqh' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location during import. This package is identified as part of a typosquatting campaign targeting Telegram users with clear malicious intent to steal information.
The PyPI package 'reqnests' versions 0.1.0 and 0.1.1 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This is a typosquatting campaign with clear malicious intent targeting Telegram data.
The PyPI package 'reqnest' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This package is identified as a typosquatting attempt with clear malicious intent targeting Telegram data.
CVE-2026-50240 is a vulnerability in Red Hat OpenShift Pipelines-as-Code (PAC) where the system does not verify if the creator of a Repository resource has permission to create PipelineRuns. This allows a namespace user with limited permissions to escalate privileges by causing PAC to execute attacker-controlled PipelineRuns with a ServiceAccount that has ClusterRole/edit permissions by default. The flaw enables namespace-scoped privilege escalation, including reading Secrets, modifying resources, and potential supply chain injection in CI/CD namespaces. Mitigation involves disabling legacyPipelineRbac in the TektonConfig custom resource to prevent auto-provisioning of the RoleBinding that grants excessive permissions.
CVE-2026-123791 is a medium severity vulnerability in OpenBMB Internet of Agents affecting the _primary_field_query function in the Agent Registry component. It involves improper neutralization of special elements in data query logic due to manipulation of the argument key. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor has not yet responded with a fix or advisory.
CVE-2026-59104 is an authentication bypass vulnerability in SPH Engineering's UgCS server versions before 6.2. The flaw exists in the HCI protocol login handler on TCP port 3334, where if the user database contains exactly one user, a login request with empty credentials is accepted as that single user. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to obtain an authenticated session and issue privileged commands such as controlling drones and uploading flight routes.
Urwid versions prior to 4.0.7 contain a vulnerability in the handle_short_request() function in urwid/display/web.py where improper encoding and decoding of POST input and polling socket output can cause Unicode errors. An attacker with a valid session token can submit crafted input that triggers UnicodeEncodeError or UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. Additionally, the POST exception path leaves a file descriptor open, which can lead to denial of service through resource exhaustion. This issue is fixed in version 4.0.7.
FileGator versions prior to 7.15.0 contain a missing authorization vulnerability in the upload functionality. A low-privileged user with upload permission can exploit the handling of resumable file uploads to access, modify, or delete temporary files belonging to other users within the shared temporary directory. This can lead to unauthorized disclosure, modification, or deletion of transient objects such as pending archives or login rate-limit lockfiles. The vulnerability is fixed in version 7.15.0.
plist.js (npm package 'plist') versions before 5.0.1 contain a vulnerability in the binary property-list parser that allows unauthenticated attackers to cause a denial of service by triggering uncontrolled resource consumption. This is achieved by crafting a small binary plist with self-referencing object indices that cause exponential recursive calls and memory growth, crashing the Node.js process.
A weakness in nexmoe VidBee up to versions 1.3.13 and 2.0.2 in the Local HTTP Service component allows remote attackers to cause information disclosure. The vulnerability exists in an unknown function within the file apps/desktop/src/main/local-api.ts. Exploit code is publicly available. Upgrading to version 2.2.0 resolves the issue.
CivetWeb versions up to 1.16, when built with HTTP/2 support enabled, contain a use-after-free vulnerability in the HTTP/2 request handling function. This flaw allows unauthenticated remote attackers to manipulate HTTP/2 HEADERS frames to influence the request method or path used by access control rules or cause a server crash.
Gitleaks versions up to 8.30.1 have a vulnerability where scan report files are created with overly permissive default permissions. This allows local users on shared systems or CI runners to read plaintext secrets in the reports unless the --redact option is used. The issue is fixed in version 8.30.2.
GPAC versions up to 26.07.0 have a type confusion vulnerability in the functions drawable_get_aspect_2d_mpeg4() and TraverseShape(). This flaw occurs because the code casts a Shape's appearance node to M_Appearance without verifying the node's tag, allowing crafted XMT files to cause invalid memory reads and crash MP4Box. The vulnerability is fixed in version 26.07.1.
A delimiter injection vulnerability exists in mistral.rs versions before 0.9.5 within the mistralrs-core component. This flaw allows attackers who can control input documents, web pages, or tool outputs to inject tool calls by embedding delimiter strings such as </tool_call>. This causes parsers like qwen-xml, gemma4, or reasoning parsers to execute additional tool calls with attacker-supplied arguments. The vulnerability is fixed in version 0.9.5.
GPAC versions up to 26.07.0 have a type confusion vulnerability in the gf_sg_command_apply() function. This flaw occurs because the function does not verify that BIFS field-replace command types match the target node fields. An attacker can exploit this by supplying a crafted XMT file, for example via chapter import in MP4Box, leading to a crash due to invalid memory access in gf_sg_vrml_field_clone(). The vulnerability is fixed in version 26.07.1.
Kopia versions up to 0.23.1 have a path traversal vulnerability in the copyDirectoryContent function. This flaw allows users with repository write access to escape the intended restore directory by using specially crafted directory entry names such as '..'. As a result, during restore operations with default settings, attacker-controlled content can be written outside the designated restore directory.
ChatWiki versions prior to 2.10.0 have a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage endpoint. This flaw allows unauthenticated attackers to access PDF-rendered pages of knowledge-base documents belonging to other tenants by enumerating sequential admin_user_id and file id parameters, bypassing ownership checks. The vulnerability is fixed in version 2.10.0.
Faveo Helpdesk versions up to 2.0.3 have a broken access control vulnerability in the TicketController's ticket_print function and the pdfThread endpoint. This flaw allows authenticated agents to access and render PDF versions of tickets from other departments by requesting arbitrary ticket IDs. The vulnerability does not verify ticket department or assignment, exposing ticket conversation threads to unauthorized users.
A pre-authentication stack-based buffer overflow vulnerability exists in the SonicOS TACACS+ authentication client. Under specific conditions, this flaw could allow a remote unauthenticated attacker to cause an application-level denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 5.9, indicating a medium severity level. No patch or remediation details are provided in the available data.