CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856

The CVE-2026-9856 entry describes a path traversal flaw in huggingface/transformers

Vulnerabilities, Secrets and Misconfiguration in the Highest-Exposure Docker Hub Images

Docker Hub is the registry underneath most container deployments, and a flaw in a widely reused base image is inherited by every image built on it. Prior ecosystem-scale measurements each rely on a single detector, leaving the tool-dependence of their counts unquantified, while the studies that d...

python313-huggingface-hub-1.26.0-1.1 on GA media (moderate)

python313-huggingface-hub-1.26.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11422-1 Rating: moderate Cross-References: CVE-2026-15717 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

PT-2026-67080

These are all security issues fixed in the python313-huggingface-hub-1.26.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-4740

A flaw was found in Open Cluster Management OCM, the technology underlying Red Hat Advanced Cluster Management ACM. Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This...

CLEANSTART-2026-AE28044 Security fixes in jupyterhub-k8s-hub 4.3.2-r3

Package jupyterhub-k8s-hub version 4.3.2-r3 fixes 2 vulnerabilities: CVE-2026-44432, CVE-2026-44431...

CLEANSTART-2026-IF40239 Security fixes in jupyterhub-k8s-hub 4.3.2-r0

Package jupyterhub-k8s-hub version 4.3.2-r0 fixes 11 vulnerabilities: CVE-2026-32597, CVE-2026-30922, CVE-2026-31958, ghsa-jr27-m4p2-rc6r, ghsa-qjxf-f2mg-c6mc...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

CVE-2023-31594

creationtimestamp| type| source ---|---|--- 2026-07-29 12:00:30+00:00| seen| https://t.me/CVEhub/13605 2026-07-30 00:00:53+00:00| seen| https://t.me/CVEhub/13605 2026-07-31 00:00:11+00:00| published-proof-of-concept| https://t.me/CVEhub/13605...

CVE-2023-36166

creationtimestamp| type| source ---|---|--- 2026-07-29 12:00:17+00:00| seen| https://t.me/CVEhub/16620 2026-07-30 00:00:37+00:00| seen| https://t.me/CVEhub/16620 2026-07-31 00:00:40+00:00| published-proof-of-concept| https://t.me/CVEhub/16620...

Important: Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update

Multicluster Global Hub v1.7.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-17107 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-17107

The CVE describes a flaw in the cluster-proxy service-proxy component used by Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without removing caller-supplied values, and the spoke ...

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

CVE-2026-48037 Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...