CVE-2026-6615 TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initia...

CVE-2026-6615

CVE-2026-6615 — TransformerOptimus SuperAGI Multipart Upload path traversal Affected: TransformerOptimus SuperAGI (up to 0.0.14). The vulnerability is in the Multipart Upload Handler, specifically the Upload function in superagi/controllers/resources.py. Manipulating the Name argument enables pat...

Server-side Request Forgery (SSRF)

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getbytesfromweburl function. An attacker can access internal resources or sensitive information by sending crafted request...

CVE-2026-6587

A flaw was found in vibrantlabsai RAGAS. A remote attacker can exploit a server-side request forgery SSRF vulnerability by manipulating the retrievedcontexts argument within the tryprocesslocalfile or tryprocessurl functions. This manipulation allows the attacker to induce the server to make...

CVE-2026-32960

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device without knowing the password by sending a crafted packet...

Pillow Resource Exhaustion DoS

The vulnerability of the Pillow image processing library is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Microsoft.NET Framework DoS

The vulnerability of the Microsoft.NET Framework is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-33864

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts module fails to restrict redirect destinations during archive...

Fudo Enterprise security vulnerabilities

Fudo Enterprise is a security control platform for privileged access management and session auditing developed by the Polish company Fudo. Versions of Fudo Enterprise 5.6.2 and earlier contained security vulnerabilities. These vulnerabilities were due to inadequate protection of API endpoints,...

CVE-2025-13480: Incorrect Authorization

Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been...

PT-2026-44323

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description An issue exists in the spi: mpc52xx component where the controller is not properly deregistered before the driver unbinds...

Apache Airflow Permission Misconfiguration

The vulnerability of the Apache Airflow network software relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-33742

Name of the Vulnerable Software and Affected Versions Fudo Enterprise versions 5.5.0 through 5.6.2 Description Low privileged users can access administrator-only resources due to improperly protected API endpoints. This allows unauthorized access to sensitive information, including system logs an...

CVE-2026-5052

A flaw was found in Vault’s PKI engine. The ACME Automated Certificate Management Environment validation process did not properly restrict requests to local network targets when handling http-01 and tls-alpn-01 challenges. This vulnerability, known as Server-Side Request Forgery SSRF, could allow...

IaC Inventory: A Unified View Across Code, Deployments, and Cloud

As AI applications introduce a new class of infrastructure resources, visibility into what your IaC creates, where it runs, and whether it has drifted has never been more critical...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007370 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpivideoswitchbrightness The switchbrightnesswork delayed wor...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via static resource resolution. An attacker can cause denia...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007244)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007244 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedrcreateuserqp error flow Avoid the following warning by making sure to free the...

[SECURITY] Fedora 44 Update: plasma-systemmonitor-6.6.4-1.fc44

An interface for monitoring system sensors, process information and other sys tem resources...

Server-side Request Forgery (SSRF)

Overview langchain-text-splitters is a LangChain text splitting utilities Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the splittextfromurl function. An attacker can access internal network resources and potentially exfiltrate sensitive data by supplying...