CVE-2026-103395: Deserialization of Untrusted Data

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

EUVD-2026-90412

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

PT-2026-103619

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description Code Injection is possible in the execute function within src/agents/runner/runner.py. This issue occurs due to the direct execution of content generated by a Large Language Model LLM, which allows an attacker to...

CVE-2026-51866

Versions 0.7.5 through 0.8.0 of DB-GPT are vulnerable to a code injection issue (CWE-94). An attacker can upload a malicious skill via the /api/v1/skills/upload endpoint, which can subsequently be executed during the /api/v1/chat/react-agent flow. The impact includes potential compromise of confi...

PT-2026-103519

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incomplete environment-variable sanitizer in the system.run function fails to block specific variables. Attackers with gateway or agent access can supply GIT CONFIG , DOTNET START...

CVE-2026-101884: Incomplete List of Disallowed Inputs

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-102119: Improper Limitation of a Pathname to a Restricted Directory

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

PT-2026-103552

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal weakness exists in an optional, non-default administrative feature. This flaw allows an authenticated administrator to move files to unintended...

PT-2026-103010

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 38.2 Pexip Infinity version 39.0 Pexip Infinity version 39.1 Pexip Infinity version 40.0 Description Improper access control on a product-internal API allows an attacker with local access to a node within an...

PT-2026-103320

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19197 Description An authorization bypass in the scripts debugger allows for arbitrary code execution. Recommendations Update to version 2026.2.19197...

AlmaLinux 9.2 [TuxCare] Security Update: opensc (ALMALINUX9.2:CLSA-2026:1788870088)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788870088 advisory. - A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious...

The vulnerability of the Cisco NX-OS operating system of Cisco Nexus 9000 Series switches, based on Silicon One ASIC chips, arises from the reliance on open IP addresses. This allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Cisco NX-OS operating system of Cisco Nexus 9000 Series switches, based on Silicon One ASIC chips, stems from the binding of open IP addresses during connection to TCP ports 43210 and 43211. Exploiting this vulnerability allows a remote attacker to execute arbitrary code ...

The vulnerability in the Web module of the Open Interface Service of the Siemens Siveillance Control software for video surveillance and security systems allows a intruder to escalate their privileges and gain full control over the system to execute arbitrary codes.

The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...

CentOS Linux 8 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1782142827)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1782142827 advisory. - SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to...

MiracleLinux 8 : postgresql:15 (AXSA:2026-1941:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1941:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS7:CLSA-2023:1697816385)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1697816385 advisory. - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1 / gstreamer1-devel (ALMALINUX9.6:CLSA-2026:1776433691)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776433691 advisory. - GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-DBI (UTSA-2026-126158)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126158 advisory. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI...

RHEL 8 : postgresql:12 (RHSA-2026:73912)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73912 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...