DEBIAN-CVE-2026-12481

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-12481

Removed by vendor...

CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-12481

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

Exploit for CVE-2026-36851

CVE-2026-36851 Path traversal in UnPollerhttps://github.co...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, zookeeper, ranger, cassandra, kafbat-ui-fips, dependency-track, dependency-track-apiserver, hadoop-fips, nacos-docker, s3proxy, sonar-scanner-cli, nextflow, kafbat-ui, keycloak-config-cli, cassandra-fips, akhq, zookeeper-fips, nacos,...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, zookeeper, ranger, cassandra, kafbat-ui-fips, dependency-track, dependency-track-apiserver, hadoop-fips, nacos-docker, s3proxy, sonar-scanner-cli, nextflow, kafbat-ui, keycloak-config-cli, cassandra-fips, akhq, zookeeper-fips, nacos,...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: cassandra, kserve-modelmesh, nextflow, akhq, cassandra-reaper, trino, zookeeper, sonar-scanner-cli, sonarqube, keycloak-config-cli, management-api-for-apache-cassandra-5.0, dependency-track...

AZL-91827 CVE-2026-8932 affecting package cmake for versions less than 3.30.3-15

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...

CVE-2026-8286

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

CVE-2026-8932

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...

SUSE CVE-2026-44494

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle MIT...

SUSE CVE-2026-44495

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse,...

SUSE CVE-2026-53099

In the Linux kernel, the following vulnerability has been resolved: bpf: Switch CONFIGCFICLANG to CONFIGCFI This was renamed in commit 23ef9d439769 "kcfi: Rename CONFIGCFICLANG to CONFIGCFI" as it is now a compiler-agnostic option. Using the wrong name results in the code getting compiled out...

PT-2026-110952

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0-rc.6 through 2.4.0 Description An authenticated attacker can bypass the security layer by using the nginx config add MCP tool to write configuration files to disk and trigger a reload. This occurs because the tool fails...

PT-2026-110977

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authentication bypass exists where the /mcp and /mcp message endpoints only require ordinary authentication, unlike other HTTP configuration mutation routes that require a secure session. This...

PT-2026-110975

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated MCP caller or an MCP agent induced via prompt injection can bypass security controls to inject dangerous Nginx directives. While the ValidateConfigFile function in...