Linux Distros Unpatched Vulnerability : CVE-2026-94543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router wit...

CVE-2026-103765 Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create...

CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) contains a vulnerability where OpenID Connect (OIDC) and OAuth discovery metadata is cached without sufficient validation or issuer-origin binding . A remote attacker providing a malicious discovery response can replace legitimate service endpoints wi...

CVE-2026-103004

A flaw was found in Next.js. This vulnerability may lead to information disclosure when nested caching features fail to properly include root parameters in their cache keys. An unauthenticated remote user can receive cached application responses intended for a different user or request context...

CVE-2026-53715

A flaw was found in Envoy Gateway. Improper synchronization in the Wasm cache handling allows an attacker with pod-network access and tenant permissions to trigger a race condition. By flooding GET requests, an attacker can cause a read-write overlap, leading to the termination of the controller...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-15307 via django (2.0.0)

django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...

django-autoconfig (>=0.6.0, <=0.7.2), django-cache-manager (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-15307 via django (1.11.0rc1)

django PYPI version 1.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-autoconfig =0.6.0, =0.5.0, =0.5.1 - django-inline-actions 1.1.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

PYSEC-2026-4174 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

Exploit for CVE-2026-100671

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal...

CVE-2026-103004

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004

Next.js versions 16.3.0 to 16.3.7 are vulnerable to a cache leak when use cache handlers access next/root-params with Cache Components enabled. The root cause is an incorrect cache key generation: if an inner use cache function reads a root param and is served from an existing entry, the enclosin...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

EUVD-2026-90872

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

WordPress Cache Enabler plugin < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion vulnerability

Unauthenticated Arbitrary File and Directory Deletion vulnerability discovered by Jakub Herman in WordPress Plugin Cache Enabler versions 1.8.17...