EUVD-2026-85932

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

CVE-2026-97225 DbGate JSON Runner runners.js code injection

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

CVE-2026-97225

A code injection vulnerability exists in DbGate versions up to 7.2.5-beta.5 within the JSON Runner component. The flaw resides in an unknown function of the file packages/api/src/controllers/runners.js, where manipulating the comment.text or script.schedule arguments can allow for remote code exe...

CVE-2026-97225 DbGate JSON Runner runners.js code injection

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

CVE-2026-97225 DbGate JSON Runner runners.js code injection

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

PT-2026-97914

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

CVE-2026-97225: Improper Control of Generation of Code

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

vulnerum

Vulnerum Run the whole vulnerability lifecycle on your own...

PT-2026-97524

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.1.0 through 7.3.0 Description Authenticated non-administrator users can achieve arbitrary code execution on a COSMOS server by writing malicious content into the targets modified/ overlay directory. This is possible...

SUSE CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

EUVD-2026-83981

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563: Incorrect Authorization

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CLEANSTART-2026-BH99085 Security fix for GHSA-6g7g-w4f8-9c9x applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.14.1-r0, grafana-alloy-fips 1.12.1-r2, kubevela 1.10.8-r0, opentelemetry-collector-contrib 0.144.0-r4, opentelemetry-collector-contrib-fips 0.144.0-r3, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, terragrunt-fips 0.94.0-r2, terragrunt-fips 0.95.1-r2, terragrunt-fips 0.96.1-r2, terragrunt-fips 0.97.2-r4, terragrunt-fips 0.98.0-r4, terragrunt-fips 0.99.4-r3, weaviate 1.35.2-r2

GHSA-6g7g-w4f8-9c9x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

secator v0.44.0

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

waldiez-runner (0.5.9) potentially affected by CVE-2026-102925 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102925 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102925 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102937 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102937 Source advisory:...

waldiez-runner (0.5.9) potentially affected by CVE-2026-102930 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102930 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102930 Source advisory:...