CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...

CVE-2025-71429

Versions of GPT-SoVITS up to and including 20250606v2pro are vulnerable to an OS command injection vulnerability in the tools/uvr5/vr.py component. The root cause is the improper neutralization of special elements, allowing unauthenticated attackers to execute arbitrary commands as the server use...

CVE-2026-89140

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-18166

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command...

CVE-2026-104355

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

thunderbird: Out-of-bounds read in IMAP response parser

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...

CVE-2026-83536 Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

EUVD-2026-97777

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

EUVD-2026-97772

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command...

EUVD-2026-97771

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-89140

The Temporal Server contains a vulnerability where internal completion callbacks are not bound to their specific namespaces. This allows an authenticated caller with write permissions in one namespace to manipulate the Scheduler V2 schedule state in a different namespace. The flaw exists because ...

EUVD-2026-97769

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

EUVD-2026-97768

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104355

A Temporal Server cluster is vulnerable to unauthorized modification of its local namespaces (including the built-in temporal-system namespace) when connected to a registered peer cluster. The root cause is an incorrect authorization logic where the receiving cluster fails to verify if a namespac...

CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-77366

The obsidian-tc Model Context Protocol server is vulnerable to an authorization bypass in versions prior to 1.3.1 . The flaw occurs because tool dispatch fails to verify that the caller-controlled input.vault value matches the vault bound to the caller, compounded by a lack of vault claims in the...