Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

RHEL 8 : container-tools:rhel8 (RHSA-2026:16701)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16701 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes:...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

DEBIAN-CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301 Hugo: Node tool execution allows file system access outside the project directory

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

CVE-2026-44301

Hugo (static site generator) versions 0.43 through 0.160.x are vulnerable when building a site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS). The vulnerability arises because Hugo invoked the configured Node tools without restrictions on file system access, potentially allowi...

CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could...

agentiq-mem0ai (>=1.1.0a20250502, <=1.1.0a20250505), aip-agents-binary (>=0.0.0b3, <=0.4.8) +19 more potentially affected by CVE-2026-31245 via mem0ai (0.1.118)

mem0ai PYPI version 0.1.118 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - agentiq-mem0ai =1.1.0a20250502, =0.0.0b3, =1.1.0a20250429, =0.13.0, =0.1.122, =0.0.2, =0.1.0.dev7, =0.1.0, =0.0.19, =1.0.0a1, =1.1.0a20251020,...

harmonai-tools (0.0.5), neuralprophet (>=0.5.0rc1, <=0.5.1) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.4)

pytorch-lightning PYPI version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - harmonai-tools 0.0.5 - neuralprophet =0.5.0rc1, =1.0.2, =1.0.4 Source cves: CVE-2026-31221 Source advisory:...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.28, <=1.0.31), org.apache.kylin:kylin-spark-classloader (4.0.4) +3 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.5.86)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.28, =1.0.31 -...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.28, <=1.0.31), org.apache.kylin:kylin-spark-classloader (4.0.4) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (8.5.86)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.28, =1.0.31 -...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

com.gantzgulch.tools:gantzgulch-tools-http (>=1.0.4, <=1.0.27), org.apache.geode:geode-modules-tomcat8 (>=1.0.0-incubating, <=1.1.1) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.5.4)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.gantzgulch.tools:gantzgulch-tools-http =1.0.4, =1.0.0-incubating, =3.2-rc1, =3.2-rc1,...

CVE-2026-43992

The CVE describes a vulnerability in JunoClaw where, prior to version 0.x.y-security-1, MCP write tools (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted a mnemonic: string parameter, causing the BIP-39 seed to be embedded in the LLM tool-call JSON. T...

CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...