Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

PT-2026-106243

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CS-Remote-OPs-BOF

Remote Operations BOF This repo serves as an addition to our previously released SA repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format. Over time, we have seen many other...

PYSEC-2026-4163 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SummaryThe AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

CentOS Linux 8 [TuxCare] Security Update: xterm / xterm-resize (CENTOS-STREAM8:CLSA-2026:1777030519)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777030519 advisory. - xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command...

PT-2026-105907

Summary The AetherBrowser API server scripts/aetherbrowser/api server.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the email reader.py subprocess, which connects to configured ProtonMail or Gmail...

GHSA-Q986-4X7X-GX39 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

CVE-2026-57443

The SCBE-AETHERMOORE geometric AI governance framework is vulnerable to CWE-306 (Missing Authentication for Critical Function) in versions 4.0.2 through 4.2.0 . The AetherBrowser API server (scripts/aetherbrowser/api_server.py) exposes the POST /api/ops/check-email endpoint without any authentica...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-57443

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server "scripts/aetherbrowser/apiserver.py" exposes the "POST /api/ops/check-email" endpoint without any authentication. Any remote attacker can call...

PT-2026-98620

In the Linux kernel, the following vulnerability has been resolved: net: net failover: Fix the deadlock in net failover slave name change This is a sibling fix of commit b84c5632c7b3 "net: net failover: Fix the deadlock in slave register". There is netdev lock ops in the upper callers, so using...

PT-2026-99120

Name of the Vulnerable Software and Affected Versions SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 Description The AetherBrowser API server scripts/aetherbrowser/api server.py exposes the POST /api/ops/check-email endpoint without authentication. A remote attacker can call this endpoint to trigg...

CVE-2026-57443: Missing Authentication for Critical Function

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-88408: Stack-based Buffer Overflow

FalkorDB Redis module v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the GetGroup function /ops/opaggregate.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-88408

FalkorDB Redis module v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the GetGroup function /ops/opaggregate.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-95933

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description Remote command injection is possible within the TASK RUN COMMAND component. The issue exists in the paramiko.SSHClient.exec command function located in the backend/ops/host tasks.py file,...

CVE-2026-93966: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.execcommand of the file backend/ops/hosttasks.py of the component TASKRUNCOMMAND. Such manipulation of the argument command leads to command injection. The attack may be...