CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...

DEBIAN-CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

DEBIAN-CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115376

Incus versions 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 are vulnerable to an authorization bypass vulnerability. By omitting the source.type parameter in a crafted POST request to the custom volumes endpoint, project-restricted clients can copy and read volumes, snapshots, and configurations fro...

EUVD-2026-108299

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...

CVE-2026-115370 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115370

The Incus container orchestration platform versions 6.0.5 before 6.0.7 , 6.12.0 before 7.0.2 , and 7.1.0 before 7.5.0 are vulnerable to a restriction bypass vulnerability. This flaw allows restricted project users to utilize pull mode migration through clustered refresh requests. Specifically, an...

CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115370 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

EUVD-2026-108293

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an...

DEBIAN-CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

The fpdf2 PDF creation library for Python (prior to version 2.8.8 ) contains a vulnerability where the shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths. This occurs when processing inputs from FPDF.image() , FPDF.write_html() (HTML values), SVG ...

CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...