actinia-core (>=4.9.1, <=4.10.0), adeso (>=0.0.1, <=0.0.4) +27 more potentially affected by CVE-2026-102598 via werkzeug (2.3.6)

werkzeug PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - actinia-core =4.9.1, =0.0.1, =0.1.23, =0.6.14, =1.0.1, =1.0.0, =1.1.0, =2024.1.1, =0.0.1, =0.0.1, =0.0.25, =0.2.27 - fortigate-vpn-login 0.5.0 a...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-102994 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

agl-ocr-reader (1.1.1), app-ocr (>=0.0.1, <=1.2.14) +7 more potentially affected by CVE-2026-64847 via anyio (3.7.0)

anyio PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - agl-ocr-reader 1.1.1 - app-ocr =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.2.0 - yt-fts 0.1.6 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-102994 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

acapy-patched-old (0.5.6), agl-predict-endo-frame (0.1.1) +271 more potentially affected by CVE-2026-54058 via pillow (7.2.0)

pillow PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - acapy-patched-old 0.5.6 - agl-predict-endo-frame 0.1.1 - ailab-lite =0.1.1, =0.0.2, =0.3.10, =0.1.0, =2020.1.0, =0.9.0, =0.9.0, =0.8.1, =0.8.1,...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-54651 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-48155 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-48156 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2026-40260 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +243 more potentially affected by CVE-2025-62707 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1, =1.4.2,...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +636 more potentially affected by CVE-2026-49460 via pypdf (>=3.1.0, <=6.12.1)

pypdf PYPI version =3.1.0, =0.1.1, =0.9.1, =0.0.2, =0.0.1, =0.1.0, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-49460 Source advisory: MEND:CVE-2026-49460...

CVE-2026-37530

AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The senddiagnosticrequest function in uds.c allocates a 6-byte stack buffer MAXDIAGNOSTICPAYLOADSIZE=6 but copies up to 7 bytes MAXUDSREQUESTPAYLOADLENGTH=7 via memcpy at an offset of 1+pidlength 2-3...

Automotive Grade Linux agl-service-can-low-level 安全漏洞

Automotive Grade Linux agl-service-can-low-level is an in-vehicle communication service component from Automotive Grade Linux. A security vulnerability exists in Automotive Grade Linux agl-service-can-low-level version 17.1.12 and earlier, which stems from an uds-c inventory overflow in the stack...

PT-2026-36505

Name of the Vulnerable Software and Affected Versions agl-service-can-low-level versions prior to 17.1.12 Description A stack buffer overflow exists in the uds-c library. The send diagnostic request function in uds.c allocates a 6-byte stack buffer but copies up to 7 bytes via memcpy at an offset...

CVE-2026-37526: Improper Access Control

AGL app-framework-binder afb-daemon through v19.90.0 allows any local process to execute privileged supervision commands Exit, Do, Sclose, Config, Trace, Debug, Token, slist without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in...

CVE-2026-37530

AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The senddiagnosticrequest function in uds.c allocates a 6-byte stack buffer MAXDIAGNOSTICPAYLOADSIZE=6 but copies up to 7 bytes MAXUDSREQUESTPAYLOADLENGTH=7 via memcpy at an offset of 1+pidlength 2-3...

CVE-2026-37531: Improper Limitation of a Pathname to a Restricted Directory

AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability CWE-22 combined with a TOCTOU race condition CWE-367 in the widget installation flow. The isvalidfilename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal...

EUVD-2026-26682

AGL app-framework-binder afb-daemon through v19.90.0 allows any local process to execute privileged supervision commands Exit, Do, Sclose, Config, Trace, Debug, Token, slist without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in...

CVE-2026-37532: Buffer Over-read

AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotpcontinuereceive receive.c:87-89, the payloadlength for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8...

PT-2026-36503

Name of the Vulnerable Software and Affected Versions AGL app-framework-binder afb-daemon versions prior to 19.90.1 Description A privilege escalation issue exists in the supervision Do command. The on supervision call function in src/afb-supervision.c nullifies request credentials by calling afb...