1417 matches found
EUVD-2026-40350
Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to...
PYSEC-2026-295 BentoML deserialization vulnerability
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...
CVE-2026-58053
Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...
EUVD-2026-39973
Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...
CVE-2026-58053 Gitea act_runner - Container Hardening Bypass via Workflow Container Options
Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...
CVE-2026-58053
Gitea act_runner (Docker backend) up to act 0.262.0 is vulnerable: the workflow.container.options are merged into the Docker job container HostConfig, and if privileged is set to false, only the Privileged flag is disabled while options such as --pid=host, --cap-add, and --security-opt remain. A ...
CVE-2026-58053
Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...
GO-2026-5481 File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser
File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser...
CVE-2026-49444
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerabili...
CVE-2026-49444 n8n: Python sandbox escape
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerabili...
CVE-2026-49444 n8n: Python sandbox escape
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerabili...
CVE-2026-49444
CVE-2026-49444 affects n8n prior to versions 1.123.48, 2.21.8, and 2.22.4 where an authenticated user with permission to create/modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. The issue is fixed in 1.123.48...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: prism, renovate, code-server, py3-captum, pelias-api, haraka, npm, gemini-cli, vitess, node-gyp, saf, kibana, actions-runner...