CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

OESA-2026-3870 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3851 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

MGASA-2026-0401 Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708

ContextForge (IBM) is an AI gateway and proxy for MCP, A2A, and REST/gRPC APIs. Prior to 1.0.3 , the /admin/gateways/test endpoint suffers from a DNS TOCTOU race condition : validate_gateway_test_url() resolves DNS and blocks private addresses at validation time, but the underlying ResilientHttpC...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.storm:storm-core is a distributed realtime computation system. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the worker-launcher process. An attacker can gain elevated privileges by exploiting a race condition between t...

CVE-2026-82429

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82430

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82429

The Apache Storm worker-launcher binary contains a Time-of-Check Time-of-Use (TOCTOU) race condition allowing Local Privilege Escalation to root . The setuid-root binary walks worker directories using FTS and calls lchown and chmod on full pathnames. Because these syscalls re-resolve paths, an un...

EUVD-2026-77528

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82430

The Apache Storm Worker Launcher is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition in its worker-launcher component. When launching Docker or OCI workers, the setuid-root launcher changes directory ownership to an untrusted user before reading the command file. Because the file...

CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...