CVE-2026-43899

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass RCE. While the patch correctly restricted...

CVE-2026-43900

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting XSS vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer...

CVE-2026-43899 DeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass RCE. While the patch correctly restricted...

@0xwork/connect (=0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.3edc9d7b8d6f <=5.0.1-staging.e195a4980892) +357 more potentially affected by unknown CVE via @mistralai/mistralai (>=2.1.2 <=2.2.1)

@mistralai/mistralai NPM version =2.1.2, =5.0.1-staging.3edc9d7b8d6f, =5.0.1-staging.3edc9d7b8d6f, =5.1.1-staging.0ad6ac75ae4a, =5.1.1-staging.0ad6ac75ae4a, =5.0.1-staging.4b92bc7a3e3b, =5.0.1-staging.3abdf9534c25, =1.0.0, =0.6.10, =3.3.0, =3.3.0, =0.1.0, =0.3.1, =0.4.0 and more Source cves:...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : CiviCRM vulnerability (USN-8242-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8242-1 advisory. Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibl...

Debian dla-4579 : python-authlib-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4579 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4579-1 [email protected]...

Ubuntu 16.04 LTS : ITK vulnerabilities (USN-8235-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8235-1 advisory. It was discovered that Expat, vendored in ITK incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute...

CVE-2025-47913 affecting package buildah for versions less than 1.43.1-1

CVE-2025-47913 affecting package buildah for versions less than 1.43.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-66215 affecting package opensc for versions less than 0.27.1-1

CVE-2025-66215 affecting package opensc for versions less than 0.27.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-13763 affecting package opensc for versions less than 0.27.1-1

CVE-2025-13763 affecting package opensc for versions less than 0.27.1-1. A patched version of the package is available...

CVE-2025-66037 affecting package opensc for versions less than 0.27.1-1

CVE-2025-66037 affecting package opensc for versions less than 0.27.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-35201 affecting package rubygem-rdiscount for versions less than 2.2.7.4-1

CVE-2026-35201 affecting package rubygem-rdiscount for versions less than 2.2.7.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-40528 affecting package opensc for versions less than 0.27.0-1

CVE-2026-40528 affecting package opensc for versions less than 0.27.0-1. A patched version of the package is available...

Amazon Linux 2 : runc, --advisory ALAS2ECS-2026-114 (ALASECS-2026-114)

The version of runc installed on the remote host is prior to 1.3.4-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-114 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler...

CVE-2026-41887

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

CVE-2026-41887 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

[SECURITY] [DSA 6253-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6253-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 08, 2026 https://www.debian.org/security/faq -...

Flarum 路径遍历漏洞

Flarum is an open-source forum software developed by Flarum for building communities. Versions of Flarum prior to 1.8.16 and 2.0.0-rc.1 contained a path traversal vulnerability. This vulnerability stemmed from the lack of restrictions on the values of LESS configuration variables, which could lea...

Ubuntu 24.04 LTS / 25.10 / 26.04 LTS : EditorConfig vulnerability (USN-8238-1)

The remote Ubuntu 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8238-1 advisory. It was discovered that EditorConfig incorrectly handled specially crafted configuration files. A local attacker could possibly use this issue ...

Ubuntu 24.04 LTS / 25.10 / 26.04 LTS : WebKitGTK vulnerabilities (USN-8237-1)

The remote Ubuntu 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8237-1 advisory. Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious...