18155 matches found
CVE-2026-56457
The CVE concerns HCL DevOps Deploy / HCL Launch with a vulnerability that allows exposure of sensitive information via output logs. The description notes that an attacker with access to the logs could potentially obtain sensitive values associated with a step. The Connected CVE lists confirm the ...
PYSEC-2026-472 PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Summary PraisonAI's MCP Model Context Protocol server praisonai mcp serve registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joi...
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to exploit this...
PYSEC-2026-276 Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if projects installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if projects installed a...
BIT-NODE-2026-48928
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...
PT-2026-53450
Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources. Details The server interpolates...
Linux Distros Unpatched Vulnerability : CVE-2026-53263
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpaniphcmcastctxaddrcompress uses &data1 as destination and...
Linux Distros Unpatched Vulnerability : CVE-2026-53095
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct...
Updated krb5 packages fix security vulnerabilities
CVE-2025-3576, A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity...
MINI-22WJ-H34M-WV9F
Bulletin has no description...
MINI-GCWF-6X44-QVX3
Bulletin has no description...
6lowpan: fix off-by-one in multicast context address compression
...
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
...
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
...
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
...
BELL-CVE-2026-53149
Bulletin has no description...
The vulnerability of the smb3_reconfigure() function in the fs/smb/client/fs_context.c module, which is part of the SMB client support in Linux kernel, allows a hacker to cause a service failure.
The vulnerability of the smb3reconfigure function in the fs/smb/client/fscontext.c module, which is part of the SMB client support in Linux kernel, involves improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...
GHSA-39G2-8X68-PMX8 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Summary PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the contex...
CVE-2026-53576
creationtimestamp| type| source ---|---|--- 2026-06-26 22:11:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xlajhsm2c 2026-06-27 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpcar4z6g52m 2026-06-29 19:25:26+00:00| seen|...
