backend-ai-accelerator-cuda-open (>=25.6.3, <=26.8.3), backend-ai-accelerator-graphcore-ipu (>=25.19.0, <=26.4.3) +6 more potentially affected by CVE-2026-59890 via setuptools (80.0.1)

setuptools PYPI version 80.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - backend-ai-accelerator-cuda-open =25.6.3, =25.19.0, =25.6.3, =25.6.3, =25.6.3, =25.6.3, =6.0.3, =6.0.4 Source cves: CVE-2026-59890 Source...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the testConnection API when a malicious H2 JDBC URL is supplied, which leverages the H2 INIT parameter. An attacker can execute arbitrary Java code on the server by sending a crafted request to the API...

openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects

A flaw was found in openCryptoki, a PKCS11 Cryptographic Token Interface Standard library. The BER/DER Basic Encoding Rules/Distinguished Encoding Rules decoding functions in the shared common library do not properly validate attacker-controlled length fields against actual buffer boundaries. Thi...

CVE-2026-44186

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

PT-2026-61024

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, as the Xvnc process is launched with insufficient authentication mechanisms. A local...

Huawei openGauss resource management error vulnerability

Huawei openGauss is an open-source relational database management system developed by Huawei Technologies of China. It features multi-core high performance, full-link security, and intelligent operations management. There is a resource management vulnerability in Huawei openGauss. This...

PYSEC-2026-1886 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

SageMaker Python SDK has Insecure TLS Configuration

SummarySageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. ImpactArbitrary Code Execution: Disabling SSL verification...

DEBIAN-CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

AZL-92186 CVE-2026-14969 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

UBUNTU-CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

aquests (>=0.7.16.17, <=0.7.16.18), backend-ai-common (1.3.1) +6 more potentially affected by CVE-2026-0994 via protobuf (3.5.2.post1)

protobuf PYPI version 3.5.2.post1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aquests =0.7.16.17, =1.3.2, =1.1.0, =0.4.1, =0.0.4, =0.8.2, =0.11.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

PYSEC-2026-1237 Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain a server-side request forgery SSRF vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2025-69229 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

vLLM vulnerable to remote code execution via transformers_utils/get_config

Summaryvllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This fetch...

agilerl (>=2.3.5.dev0, <=2.4.1.dev1), arbor-ai (0.2.17) +7 more potentially affected by CVE-2025-9141 via vllm (>=0.10.0, <=0.10.1)

vllm PYPI version =0.10.0, =2.3.5.dev0, =0.1.2, =0.1.5, =0.2.4, =0.1.2, =0.2.1.dev0, =0.3.0 Source cves: CVE-2025-9141 Source advisory: OSV:PYSEC-2026-2014...

PYSEC-2026-1967 TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

Description A critical path traversal vulnerability CWE-22 has been identified in the reviewpaper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. Impact...

TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

DescriptionA critical path traversal vulnerability CWE-22 has been identified in the reviewpaper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions...