abs-langchain-suite (>=0.2.1, <=0.3.1), adxp-cli (>=0.1.1, <=0.1.21) +146 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (3.0.1)

langgraph-checkpoint PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.2.1, =0.1.1, =0.0.1a1, =2.1.7, =0.0.2, =1.3.9, =0.1.3, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =1.0.0,...

Remote Code Execution (RCE)

Apache Airflow is vulnerable to Remote Code ExecutionRCE. The vulnerability is due to improper validation in the /api/v2/dagReports endpoint, which allows an attacker to execute DAG code in the context of the API server when DAG files are accessible in the deployment environment...

CVE-2026-27203 eBay API MCP Server Affected by Environment Variable Injection

eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebaysetusertokens tool allows updating the .env file with new tokens...

CVE-2026-26057

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

kube-apiserver DoS

The vulnerability of the kube-apiserver component, which is part of the Kubernetes cluster management software, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-26057

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

CVE-2026-26057

The CVE-2026-26057 entry documents a vulnerability in Skill Scanner’s API Server where erroneous binding to multiple interfaces allows an unauthenticated, remote attacker to interact with the server API, potentially causing memory starvation (DoS) or uploading files to arbitrary folders. Affected...

CVE-2026-26057

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

CVE-2026-26057 Skill Scanner Unsecured Network Binding Vulnerability

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

CVE-2026-26057 Skill Scanner Unsecured Network Binding Vulnerability

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

CVE-2026-26057: Exposure of Resource to Wrong Sphere

Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of...

PT-2026-20911

Name of the Vulnerable Software and Affected Versions Skill-scanner versions 1.0.1 and earlier Description Skill Scanner is a security scanner for AI Agent Skills designed to detect prompt injection, data exfiltration, and malicious code patterns. A flaw in the API Server component could permit a...

agent-api-server (>=2.1.7, <=2.1.16), ai-infra (>=0.1.3, <=0.1.70) +19 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.10, <=0.6.2)

langsmith PYPI version =0.4.10, =2.1.7, =0.1.3, =3.0.3, =0.3.1, =1.0.2, =0.1.0, =0.2.1, =2.1.21, =0.2.1, =1.0.0, =0.3.2, =0.4.1 - opea-comps 1.5.0 and more Source cves: CVE-2026-25528 Source advisory: SNYK:PYTHON-LANGSMITH-15253026...

Vulnerability fixed in SmarterTools SmarterMail

SmarterTools has fixed vulnerabilities in SmarterMail. A malicious party could exploit the vulnerabilities to bypass authentication and execute arbitrary code with administrator privileges, and possibly SYSTEM. For successful abuse, the malicious party must have access to the API interface...

Operation on a Resource after Expiration or Release

Overview Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the macaroon validation for cross-model authorization. An attacker can maintain unauthorized access to resources by crafting and submitting an invalid macaroon that is incorrectly...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ImageStreamImport mechanism that handles user-supplied image references without proper IP address and network-range validation. An attacker can access internal network resources, enumerate service...

CVE-2025-14443

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service DoS through Server-Side Request Forgery SSRF due to missing IP address and network-range validation when processi...

CVE-2025-14443 Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service DoS through Server-Side Request Forgery SSRF due to missing IP address and network-range validation when processi...

CVE-2025-14443 Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service DoS through Server-Side Request Forgery SSRF due to missing IP address and network-range validation when processi...

@cedarjs/api-server (>=1.0.0-canary.12863, <=1.0.0-canary.12881), @cedarjs/cli (>=1.0.0-canary.12863, <=2.0.3-next.1) +10 more potentially affected by CVE-2025-67779 via react-server-dom-webpack (>=19.2.1, <=19.2.2)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...