CVE-2026-24169

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

EUVD-2026-65609

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

CVE-2026-24169

NVIDIA UFM Enterprise contains a vulnerability in its plugin management API . An authenticated user with low privileges can inject code by sending a specially crafted API request. A successful exploit may lead to code execution , privilege escalation , and information disclosure . The CVSS 3.1 sc...

CVE-2026-24169

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

CVE-2026-24169

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

CVE-2026-55546

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol MCP command in a specially crafted notebook, according to VulnCheck's CVE Numbering Authority CNA record. The CNA record says the command can...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the direct-SQL partition-name resolution paths in DirectSqlUpdatePart.getPartitionInfo and MetaStoreDirectSql.getPartitionsByNames. An attacker can cause metastore RPCs to target unintended partitions by...

CLSA-2026-1787649192 Fix CVE(s): CVE-2026-73072, CVE-2026-73076, CVE-2026-73078

SECURITY UPDATE: Heap buffer overflow in setsofo in src/spellfile.c: a crafted spell file with an SNSAL section before an SNSOFO section leaves slsalfirst entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation -...

Arbitrary Code Injection

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Arbitrary Code Injection via the VACUUM INTO process in SQLite query handling. An attacker can execute arbitrary code on the server by crafting a query that writes PHP code to...

PT-2026-81500

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

PT-2026-81397

Name of the Vulnerable Software and Affected Versions QWED versions prior to 5.1.2 Description Authenticated users can execute arbitrary Python code within the API server process because the qwed package passes user-controlled math expressions to the SymPy parse expr function without restricting...

PT-2026-81809

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Code injection in Bisection allows a remote attacker to obtain sensitive information through the use of a crafted file. Recommendations Update Google Chrome to version 152.0.7977.65 or...

CVE-2026-79249: Improper Control of Generation of Code

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. Chromium security severity: Medium...

CVE-2026-65082: Improper Control of Generation of Code

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...

Security Bulletin: NVIDIA Unified Fabric Manager - August 2026

NVIDIA has released a software update for NVIDIA® Unified Fabric Manager UFM. To protect your system, follow instructions to clone or update this software to version 6.24 or later from the UFM NVIDIA Application Hub. Go to NVIDIA Product Security. Details NVIDIA has released a software update for...

CVE-2026-24169: Improper Neutralization of Special Elements used in a Command

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

PT-2026-81382

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the backendconfig property deserialization in the profile edit API endpoint. An attacker can inject arbitrary configuration values that are written verbatim into the generated Liquidsoap script, enabling...