🔗 go-git Symlink Escape Can Reach Files Outside Worktrees
Teams that clone or process untrusted repositories with go-git should upgrade to 5.19.2 or 6.0.0-alpha.5 promptly, especially where applications can access sensitive host files.
CVE-2026-71556 affects go-git before versions 5.19.2 and 6.0.0-alpha.5, where worktree operations can follow malicious symbolic links beyond the intended working directory. A crafted repository can cause applications using checkout, status, or add operations to read from or write to files outside the worktree. The vulnerability is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
💥 ZenML Artifact Poisoning Enables Remote Code Execution
ZenML operators using shared artifact stores should treat this as urgent, particularly where multiple users or pipelines can write artifacts. Restrict artifact-store write access and apply vendor remediation as soon as possible.
CVE-2026-68772 is a remote code execution vulnerability in the CloudpickleMaterializer component of ZenML 0.94.6. An attacker with write access to a shared artifact store can replace artifact.pkl with a malicious cloudpickle payload that executes arbitrary system commands when another user or pipeline materializes the artifact. The vulnerability is rated HIGH with CVSS 8.0.
🔗 Read more 🔗
Source: NVD
🛑 Absinthe Federation Atom Exhaustion Can Crash Erlang Nodes
Internet-facing GraphQL services using affected absinthe_federation versions should upgrade to 0.9.3 or later urgently. No authentication is required, and successful exploitation can crash the application until it is restarted.
CVE-2026-67585 affects DivvyPayHQ absinthe_federation from 0.1.0 before 0.9.3 and allows an unauthenticated remote attacker to exhaust the Erlang VM atom table through crafted _entities representation keys. Because dynamically created atoms are never garbage collected, a small number of requests containing many unique keys can exhaust the table and abort the BEAM node. The availability-only vulnerability is rated HIGH with CVSS 8.7.
🔗 Read more 🔗
Source: NVD
🦠 ClamAV XAR Parser Memory Corruption Can Trigger DoS
Organizations scanning untrusted uploads, email attachments, or downloaded files with ClamAV should patch promptly. Internet-facing gateways where attackers can repeatedly submit files deserve especially fast remediation.
CVE-2026-20348 affects the XAR file format parser in ClamAV and can be triggered remotely without authentication by submitting crafted XAR content for scanning. Improper boundary checks can cause memory corruption and terminate the ClamAV scanning process, resulting in denial of service and potentially other expanded impacts. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🦠 Crafted Mach-O Files Can Crash ClamAV Scanners
Patch ClamAV installations that inspect files from untrusted sources, particularly mail gateways and upload-scanning services. Systems exposed to repeated attacker-controlled file submissions should be prioritized.
CVE-2026-20347 affects the Mach-O file format parser in ClamAV and allows an unauthenticated remote attacker to trigger an out-of-bounds buffer read during scanning. A crafted Mach-O file can exploit improper boundary checks, potentially causing memory corruption and termination of the ClamAV scanning process. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
📄 Malicious PDFs Can Knock ClamAV Scanning Offline
ClamAV deployments that scan inbound PDFs from email, web uploads, or other untrusted sources should patch promptly. Prioritize high-volume security gateways where a scanner crash could disrupt malware inspection.
CVE-2026-20346 affects the PDF file format parser in ClamAV and can be exploited remotely without authentication using a crafted PDF submitted for scanning. Improper boundary checks may cause an out-of-bounds buffer read, memory corruption, and termination of the scanning process. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💾 ClamAV GPT Parser Flaw Allows Out-of-Bounds Writes
ClamAV users processing attacker-controlled or externally supplied files should patch promptly. The out-of-bounds write makes this particularly important for exposed scanning services and security gateways.
CVE-2026-20345 affects the GPT file format parser in ClamAV, where improper handling of an endian conversion operation can result in an out-of-bounds buffer write. An unauthenticated remote attacker can submit crafted GPT content for scanning and potentially terminate the ClamAV process, causing denial of service. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
⚠️ ClamAV PESpin Integer Overflow Can Crash Scanners
Patch ClamAV systems that routinely scan files supplied by untrusted users or external services. Mail, upload, and malware-analysis pipelines should be prioritized because repeated malicious submissions could disrupt scanning availability.
CVE-2026-20339 affects the PESpin file format parser in ClamAV and stems from improper boundary checks that may cause an integer overflow during scanning. An unauthenticated remote attacker can submit crafted PESpin content that may lead to memory corruption and termination of the ClamAV scanning process. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🗜️ ClamAV ZIP Double-Free Vulnerability Enables Remote DoS
ClamAV installations scanning untrusted ZIP archives should patch promptly, with internet-facing mail and upload gateways at the front of the queue. Attackers able to submit files repeatedly could use the flaw to disrupt scanning.
CVE-2026-20338 affects the ZIP archive parser in ClamAV and can be triggered remotely without authentication by submitting a crafted ZIP file for scanning. Improper memory handling can cause a double-free that terminates the ClamAV scanning process and produces a denial-of-service condition. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🗜️ Crafted ZIP Files Trigger Out-of-Bounds Writes in ClamAV
Organizations using ClamAV to inspect untrusted archives should patch promptly. Give priority to email gateways, public upload services, and other systems where attackers can directly feed ZIP files into the scanner.
CVE-2026-20337 affects the ZIP archive parser in ClamAV and allows an unauthenticated remote attacker to trigger an out-of-bounds write during scanning. A specially crafted ZIP file can exploit improper boundary checks and terminate the ClamAV scanning process, causing denial of service. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💉 Public SQL Injection Exploit Targets Photo Share Website
Anyone running SourceCodester Photo Share Website 1.0 should remediate or isolate the application urgently because a public exploit is available. Restrict exposure until a fix is applied, and review database and application logs for suspicious signup requests.
CVE-2026-19211 affects SourceCodester Photo Share Website 1.0 and is a remotely exploitable SQL injection vulnerability in /social/ajax.php?action=signup through manipulation of the email argument. The exploit has been made public and could be used by attackers. The vulnerability is rated HIGH with CVSS 7.3.
🔗 Read more 🔗
Source: NVD
🚨 Nexus Repository DataStore Setting Can Lead to Remote Code Execution
Nexus Repository 3 administrators should patch or apply vendor remediation urgently, especially where users or automation accounts hold nx-datastores-update. Review who has that permission and reduce it immediately where it is not required.
CVE-2026-17603 affects Nexus Repository 3 because its DataStore configuration API did not sufficiently restrict HikariCP connection-pool properties. A user with the nx-datastores-update permission can set connectionInitSql to execute arbitrary SQL on new database connections, and the default H2 backend can turn this into remote code execution as the Nexus process user. The vulnerability is rated HIGH with CVSS 8.7.
🔗 Read more 🔗
Source: NVD