CVE-2025-27770: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

CVE-2025-27771: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

PT-2026-76685

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.11 Description Unauthenticated payment webhook endpoints read and log full request bodies before performing signature validation. This occurs in router/api-router.go and the payment controllers. An...

PT-2026-76687

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.2 Description An issue exists in the /new run endpoint that allows remote code execution. Authenticated users can execute arbitrary code on the host system, typically within the Docker container, by manipulating t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: docker (UTSA-2026-050390)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-050390 advisory. Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypass...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100560)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100560 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add...

CVE-2025-27772: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099722 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add...

ogre:script_fuzz: Container-overflow in Ogre::TextureUnitState::_unload

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=5934574946025472 Project: ogre Fuzzing Engine: libFuzzer Fuzz Target: scriptfuzz Job Type: libfuzzerasanogre Platform Id: linux Crash Type: Container-overflow WRITE 8 Crash Address: 0x7bf5bfde0930 Cra...

Exploit for CVE-2026-73519

CVE-2026-73519 — WolfStack Hardcoded Cluster Secret → Unauthen...

GHSA-HQVF-45JJ-MCCQ vulnerabilities

Vulnerabilities for packages: localstack...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: aws-iam-authenticator-fips, zitadel, kubescape-server-fips, longhorn-cli, crossplane-provider-aws-rds, envoy-ai-gateway, packer-fips, thanos-fips, cadence, hubble-fips, crossplane-provider-aws-redshift, kubernetes-csi-external-provisioner, tfsec, grept-fips,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: mountpoint-s3-csi-driver, cluster-api-ipam-provider-in-cluster, tfsec, kubewatch, pvc-autoresizer, sbom-convert, dockerize, blob-csi, pulumi-language-java, bento, calico, speedtest-go, terraform-provider-google, kuberay-operator, descheduler, redis-operator, src,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: mountpoint-s3-csi-driver, cluster-api-ipam-provider-in-cluster, tfsec, kubewatch, mongo-tools, datadog-agent, pvc-autoresizer, sbom-convert, dockerize, blob-csi, pulumi-language-java, bento, calico, speedtest-go, terraform-provider-google, kuberay-operator,...

PT-2026-76446

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11520-1 kubevirt1.9-container-disk-1.9.0-1.1 on GA media

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: druid, opensearch, infinispan, kafka-bridge-fips, nuxeo, apache-activemq-fips, trino, apache-pulsar-fips, apache-pulsar, sonarqube, airbyte-platform-fips, celeborn, apache-camel-karavan-devmode, geoserver, kafka, solr, spark-fips, zipkin, kafbat-ui, spark,...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, aws-iam-authenticator-fips, zitadel, kubescape-server-fips, packer-fips, crossplane-provider-aws-rds, envoy-ai-gateway, pgpool2exporter, thanos-fips, cadence, hubble-fips, crossplane-provider-aws-redshift,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, aws-iam-authenticator-fips, zitadel, longhorn-cli, packer-fips, tfsec, crossplane-provider-aws-lakeformation-fips, prometheus-operator-fips, crossplane-provider-aws-ram-fips, melange, kubernetes-csi-driver-hostpath,...