CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

EUVD-2026-48336

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

CVE-2026-65699

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

CVE-2026-65699 AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

MINI-4MPV-646Q-CCWF

Bulletin has no description...

MINI-MWH8-24W6-RM59

Bulletin has no description...

MINI-W38V-85HC-5F9H

Bulletin has no description...

MINI-544P-FF8G-C437

Bulletin has no description...

MINI-GW5M-QM6M-59RH

Bulletin has no description...

MINI-522C-FW5G-M5X5

Bulletin has no description...

MINI-P43R-HCMR-5WWG

Bulletin has no description...

MINI-9848-XRHQ-282P

Bulletin has no description...

MINI-MPF2-388R-985H

Bulletin has no description...

MINI-H26C-HH6Q-VRHF

Bulletin has no description...

MINI-GV3C-MV33-5FWR

Bulletin has no description...

MINI-M738-2H77-F2FH

Bulletin has no description...

MINI-264F-2X6M-P57W

Bulletin has no description...

DEBIAN-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

EUVD-2026-48269

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...