1124 matches found
CVE-2026-18608 Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide
A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...
CVE-2026-18608
A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...
PT-2026-69960
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the 'V1 API' path. This issue allows the API server t...
PT-2026-69956
Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists where the operator uses a cryptographically weak pseudo-random number generator PRNG—a mathematical algorithm used to generate sequences of numbers that...
PT-2026-69959
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...
PT-2026-69957
Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists in the Data Science Pipelines Operator where a namespace editor can inject dangerous parameters into the MySQL Data Source Name DSN string via the...
CVE-2026-61808
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-61808
CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...
CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-12261
A flaw was found in the nltk.downloader component of NLTK. This vulnerability allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces and only validates package integrity after extraction. This design flaw enables one package to...
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
CVE-2026-53985
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can...
EUVD-2026-54095
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can...
GHSA-22JQ-VG5J-6VGG vulnerabilities
Vulnerabilities for packages: langfuse, renovate, kubeflow-pipelines, lerna, sqlpad, pulumi, code-server, prism, npm, opensearch-dashboards...
CVE-2026-69192 vulnerabilities
Vulnerabilities for packages: langfuse, renovate, kubeflow-pipelines, lerna, sqlpad, pulumi, code-server, prism, npm, opensearch-dashboards...
CVE-2026-54272 vulnerabilities
Vulnerabilities for packages: langfuse, renovate, kubeflow-pipelines, lerna, sqlpad, pulumi, code-server, prism, npm, opensearch-dashboards...
GHSA-MWP4-54F8-5FHR vulnerabilities
Vulnerabilities for packages: langfuse, renovate, kubeflow-pipelines, lerna, sqlpad, pulumi, code-server, prism, npm, opensearch-dashboards...