123 matches found
Astra Linux – Vulnerability in Zabbix
JavaScript preprocessing, webhooks, and global scripts can lead to uncontrolled utilization of CPU, memory, and disk I/O resources. The ability to preprocess/webhook/configure and test global scripts is only available to Administrative roles Admin and Superadmin. Administrative privileges should...
Zabbix 7.0.x < 7.0.28 / 7.4.x < 7.4.12 OOB Read (ZBX-28073)
The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.28, or 7.4.x prior to 7.4.12. It is, therefore, affected by an out-of-bounds read vulnerability: - A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScrip...
Zabbix Server 6.0.x < 6.0.47 / 7.0.x < 7.0.27 / 7.4.x < 7.4.11 DoS (ZBX-28075)
The version of Zabbix Server installed on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.27, or 7.4.x prior to 7.4.11. It is, therefore, affected by a denial of service vulnerability: - An authenticated administrator is able to crash Zabbix server by creating specifically crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-23938
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to...
DEBIAN-CVE-2026-23938
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...
DEBIAN-CVE-2026-23935
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...
EUVD-2026-60741
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...
CVE-2026-23938
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...
CVE-2026-23938 Server DoS via JavaScript preprocessing or script items
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...
EUVD-2026-60739
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...
PYSEC-2026-3406 vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Summary Issue 1: EXIF orientation not normalized → The image orientation processed by the model differs from how humans view it, introducing interpretation bias. Issue 2: PNG tRNS not explicitly flattened before converting to RGB → After conversion, transparent/semi-transparent pixels are rendere...
PYSEC-2026-2903 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
CVE-2026-55646
vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/audio/transcriptions and /v1/audio/translations routes call request.file.read to fully materialize an uploaded audio file into memory before vLLM checks the documented VLLMMAXAUDIOCLIPFILESIZEMB...
XXE Vulnerability in MerlinReader
Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...
NCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
Feature selection is critical for network intrusion detection systems NIDS operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes and thus fai...
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
Astra Linux – Vulnerability in Zabbix
JavaScript preprocessing can be exploited by attackers to gain access to the file system read-only access on behalf of the user “zabbix” on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data...
CVE-2025-47390
Memory corruption while preprocessing IOCTL request in JPEG driver...