MAL-2026-7045 Malicious code in @athena-ui-components/lang (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7044 Malicious code in @athena-ui-components/hooks (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @athena-ui-components/helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7043 Malicious code in @athena-ui-components/helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @athena-ui-components/graceful-degradation (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7042 Malicious code in @athena-ui-components/graceful-degradation (npm)

--- -= Per source details. Do not edit below this line.=-...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-3099 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-3099 Source advisory: OSV:PYSEC-2026-1645...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1558 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1558 Source advisory: OSV:PYSEC-2026-1653...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1594 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1594 Source advisory: OSV:PYSEC-2026-1655...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6940 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6940 Source advisory: OSV:PYSEC-2026-1652...

PYSEC-2026-868 OpenStack Cinder, glance, and Nova vulnerable to Path Traversal

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, a...

Segfault in `CompositeTensorVariantToComponents`

ImpactAn input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.rawops.CompositeTensorVariantToComponents.pythonimport tensorflow as tfencode = tf.rawops.EmptyTensorListelementdtype=tf.int32, elementshape=10, 15, maxnumelements=2meta=...

PT-2026-56284

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component...

PT-2026-56224

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in modalreturn layouts of various components allows for Cross-Site Scripting XSS, a technique where malicious scripts are injected into trusted websites. Recommendations...

CVE-2026-55647: Improper Neutralization of Input During Web Page Generation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable...

CVE-2026-43866 Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-42527 Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

CVE-2026-42527

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...

PT-2026-55883

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21225-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21225-1 advisory. This update for rmt-server fixes the following issue Update to 3.0.0: - CVE-2026-42256: net-imap: hostile server can perform a DoS on client...