EUVD-2026-104130

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...

ANT-2026-Y9CTVKPP · jetty/jetty.project · Denial of Service / Resource Exhaustion

denial-of-service high GHSA-85fq-fc5f-7j7g Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-Y9CTVKPP: WebSocket reserved opcode...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +431 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYWEBSOCKET-19644206...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +292 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0.alpha0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory:...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +427 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +288 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...

CVE-2026-39253

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components...

PT-2026-51582

Name of the Vulnerable Software and Affected Versions Pivotal CRM version 6.6.04.08 Description A remote attacker can execute arbitrary code through the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components. Recommendations At the moment, there is no information abo...

CVE-2026-39253

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components...

CVE-2026-39253

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components...

@abovethefray/klaviyo-adobe-commerce-app-checkout-consent-dropin (>=0.0.1, <=1.0.0), @adobe-commerce/elsie (>=1.0.0-alpha04071347, <=2.0.0-alpha-20260514091936) +115 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=8.0.0-alpha.0, <=8.6.14)

@storybook/core-common NPM version =8.0.0-alpha.0, =0.0.1, =1.0.0-alpha04071347, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.213-beta.38, =0.38.0, =0.41.1, =1.0.0, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.16.0, =1.17.0 and more Source cves: CVE-2025-68429 Source...

31g-form-parser (>=1.0.1, <=1.0.126), @1024pix/storybook-ember (7.1.1) +198 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=7.0.0, <=7.6.20)

@storybook/core-common NPM version =7.0.0, =1.0.1, =0.0.18, =2.0.5, =1.1.1, =0.0.1, =0.0.4, =0.38.0-rc.0, =0.0.0-dev-main.202308160724, =0.0.0-dev-main.202307180716, =0.0.0-dev.main.f64cee8 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKCORECOMMON-14470053...

Insertion of Sensitive Information into Externally-Accessible File or Directory

Overview @storybook/core-common is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory via the storybook build command. An attacker can access sensitive environment variables by...

Server-side Request Forgery (SSRF)

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: OSV:GHSA-F6M8-QM7J-FH65...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: SNYK:JAVA-ORGAPACHEKYLIN-13181847...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: GHSA-F6M8-QM7J-FH65...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61733 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61733 Source advisory: GHSA-MR9J-4J48-XCM2...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: GHSA-P86W-W5RH-M3HX...