PT-2026-70251

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0847 Description The runtime/autoload/vimball.vim file allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When the vimballRmVimball function later...

The vulnerability of the Shadow MMU management mechanism for page-level shadow tables in the KVM subsystem of the Linux operating system allows a perpetrator to escalate their privileges, execute arbitrary code, or cause service interruptions.

The vulnerability of the Shadow MMU management mechanism for virtual machine tables in Linux kernel-based virtual machines is related to the dereferencing of pointers with expired lifetimes. Exploiting this vulnerability can allow an attacker to enhance their privileges, execute arbitrary code, o...

KLA91211 ACE vulnerability in Microsoft SQL Server

Arbitrary code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-65811 Exploitation Related products Microsoft-Power-BI CVE list CVE-2026-65811 critical KB list Solution Install necessa...

PT-2026-70600

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs when a...

CVE-2026-72911

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18951

A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...

CVE-2026-18948

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-15467

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72911

ERPNext has a server-side template injection vulnerability affecting the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. Unrestricted globals (including frappe.utils) allow an authenticated user with a common ...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55821

A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55818

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18942 Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18942

The CVE-2026-18942 entry concerns the Feast operator. A malicious tenant could inject arbitrary code into their feature repository, and that code could be executed by an automated process with elevated privileges. This could lead to credentials theft and direct escalation of privileges, potential...

CVE-2026-18621 Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

A flaw was found in Data Science Pipelines DSP. An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf o...