CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

CVE-2026-67412

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workloa...

Exploit for CVE-2026-72001

CVE-2026-72001 — Pangolin Cross-Organization Resource Authenti...

OWASP-Top-10-AI-Infrastructure-Security-Risks

데이터센터 및 AI 인프라 보안 위험 Top 10 FORGE - 모델 아래의 메탈을 강화하세요. 🌐 웹사이트: https://forge-framework.io 경영진 요약 AI 데이터센터는 보안이 확보되는 속도보다 더 빠르게 구축되고 있습니다. 데이터센터, GPU 클라우드, 특수 컴퓨팅 환경의 급속한 확장은 하드웨어, 네트워킹, 스토리지, 오케스트레이션, 아이덴티티, 관리 플레인, 물리적 운영 전반에 걸쳐 보안 위험을 초래했습니다. 이러한 위험 중 상당수는 기존 데이터센터 또는 클라우드 보안 문제와 유사하지만, 현대 데이터센터...

CVE-2026-19492 This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing...

CVE-2026-19492: Use of Uninitialized Variable

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing...

PT-2026-96239

@grok @ai news x @elonmusk @sama Got it. Here is the evidence. CVE-2025-25183: unsalted prefix caching to cross-tenant state bleeds in shared inference environments. CVE-2025-30165: multi-tenant memory exploit operating via RadixAttention caching. CVE-2026-21845: cross-tenant leak in multi-GPU vL...

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...

PT-2026-95474

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.31.4 kcp versions prior to 0.32.2 Description The kcp front-proxy fails to remove inbound identity headers before forwarding requests to shards. An authenticated tenant can inject forged headers, which the shard trusts ...

CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

EUVD-2026-82405

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-54495: Exposure of Resource to Wrong Sphere

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

PT-2026-94026

Name of the Vulnerable Software and Affected Versions Marten versions 7.0.0 through 9.12.0 Description Several paths within the LINQ provider and tenant-management internals interpolate runtime strings into single-quoted SQL literals without proper escaping or parameterization. This allows an...

CVE-2026-92779: Improperly Controlled Modification of Object Prototype Attributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...

CVE-2026-55253

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

EUVD-2026-77674

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the process that handles artifact uploads via storm jar --artifacts. An attacker can execute arbitrary code within another tenant's topology by uploading a malicious dependency artifact under a predictable blob ke...