CVE-2026-15467

Trustyai-service-operator vulnerability CVE-2026-15467 affects the LMEvalJob controller. An authenticated cluster user can abuse a sidecar container to bypass environment-variable filtering and security policies, enabling remote code execution within the cluster. CVSS 3.1 base score 8.1 (HIGH) wi...

GHSA-XC48-889X-5QMW Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Summary The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and npm reads its configuration...

MiracleLinux 3 : sudo-1.7.2p1-29.AXS3 (AXSA:2014-229:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-229:01 advisory. Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all...