EUVD-2026-62404

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76236 stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76236

stigmem-node before 0.9.0a12 contains a cross-tenant BOLA flaw in its RTBF (right-to-be-forgotten) tombstone mechanism. Two defects combine: issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, and the read-suppression path (_get_tombstone_filter and _tombstone_scope_...

CVE-2026-76237

stigmem-node before 0.9.0a12 has a cross-tenant BOLA flaw in quarantine review endpoints: list/count queries and _get_quarantined_fact in routes/quarantine.py lack a tenant_id predicate, and the garden lookup is not tenant-scoped, allowing a low-privilege tenant admin to read, admit, or reject ot...

CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

EUVD-2026-62477

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

EUVD-2026-62476

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-74355

A flaw was found in the Linux kernel's iommu/vt-d component. This vulnerability occurs when the info-node RB-tree member is zero-initialized, and a device that does not support Address Translation Services ATS skips the devicerbtreeinsert call. If a subsequent probe step fails, the error path...

vantage6-node (3.1.1rc2), vantage6-server (3.1.1rc2) potentially affected by CVE-2026-73652 via vantage6 (3.1.1rc2)

vantage6 PYPI version 3.1.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.1rc2 - vantage6-server 3.1.1rc2 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.1.0rc8), vantage6-server (3.1.0rc8) potentially affected by CVE-2026-73652 via vantage6 (3.1.0rc8)

vantage6 PYPI version 3.1.0rc8 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0rc8 - vantage6-server 3.1.0rc8 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.1.0), vantage6-server (3.1.0) potentially affected by CVE-2026-73652 via vantage6 (3.1.0)

vantage6 PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0 - vantage6-server 3.1.0 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.1.0rc6), vantage6-server (3.1.0rc6) potentially affected by CVE-2026-73652 via vantage6 (3.1.0rc6)

vantage6 PYPI version 3.1.0rc6 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0rc6 - vantage6-server 3.1.0rc6 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.1.0rc7), vantage6-server (3.1.0rc7) potentially affected by CVE-2026-73652 via vantage6 (3.1.0rc7)

vantage6 PYPI version 3.1.0rc7 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0rc7 - vantage6-server 3.1.0rc7 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.2.0rc5), vantage6-server (3.2.0rc5) potentially affected by CVE-2026-73652 via vantage6 (3.2.0rc5)

vantage6 PYPI version 3.2.0rc5 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.2.0rc5 - vantage6-server 3.2.0rc5 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.2.0), vantage6-server (3.2.0) potentially affected by CVE-2026-73652 via vantage6 (3.2.0)

vantage6 PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.2.0 - vantage6-server 3.2.0 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...