CVE-2026-53538 vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

GHSA-V9PG-7XVM-68HF vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

GHSA-6JV3-5F52-599M vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

GHSA-VFFW-93WF-4J4Q vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

CVE-2026-53537 vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

CVE-2026-53539 vulnerabilities

Vulnerabilities for packages: airflow, wazuh-manager, wazuh-manager-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, airflow-postgres-fips, litellm...

SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

...

Malicious code in cryptodao-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbe5f8614a264a8d3cdd2ecf8ecd2ad17292dbb5c5bcc25d0ae9d77eb8821df package.json declares postinstall: node recon.js, which auto-runs on npm install. recon.js lines 30-46 scrapes a curated list of credential-bearing...

MAL-2026-5966 Malicious code in cryptodao-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbe5f8614a264a8d3cdd2ecf8ecd2ad17292dbb5c5bcc25d0ae9d77eb8821df package.json declares postinstall: node recon.js, which auto-runs on npm install. recon.js lines 30-46 scrapes a curated list of credential-bearing...

PT-2026-50495

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.21 Traefik versions prior to 3.7.5 Description An issue exists in the Kubernetes Gateway provider regarding the crossProviderNamespaces allowlist. When HTTPRoute rules declare multiple backendRefs Weighted Round...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...

PT-2026-50538

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to commit ff45d3b Description Tinyproxy fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine the number o...

PT-2026-50524

Name of the Vulnerable Software and Affected Versions Devolutions UniGetUI versions prior to 2026.2.1 Description The pinget backend contains an issue where names or references are incorrectly resolved. This allows a WinGet community catalog contributor to correlate an installed application with ...

nginx -- multiple vulnerabilities

The nginx developers report: A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders off;" and "largeclientheaderbuffers" directives with large configured values while proxying a specially crafted request to an HTTP/2 or gRPC backend may allow memory corruption or a...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory. It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An...

PT-2026-50479

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The chat message listener in the chat page's window message listener processes input:prompt and action:submit messages without enforcing same-origin restrictions. This allows an external site to s...

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...

CVE-2026-2604

Summary: CVE-2026-2604 affects evolution-data-server. An inconsistent comparison logic in the addressbook backend lets a Flatpak/D-Bus user craft a malicious URI with directory traversal sequences. This URI is stored during contact creation/modification and later rechecked with lower strictness d...

CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

CVE-2026-54283 vulnerabilities

Vulnerabilities for packages: semgrep, airflow, mlflow-fips, tritonserver-backend-vllm-cuda-12.9, airflow-core, prefect, airflow-postgres-fips, mlflow, nemo, prefect-fips, litellm, tritonserver-backend-vllm-cuda-13.0...