CVE-2026-41870

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-41871

Apache Nutch versions 1.10 through 1.22 are vulnerable to a Missing Authorization and Unsafe Reflection vulnerability within the Nutch Server (Nutch REST API) . The root cause involves the use of externally-controlled input to select classes or code, which can lead to unauthenticated reflection-b...

CVE-2026-41871 Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

EUVD-2026-74803

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

CVE-2026-41870 Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

EUVD-2026-74801

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-41870: Missing Authorization

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-41871: Missing Authorization

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

PT-2026-88919

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

PT-2026-88920

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

SUSE CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008

A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without...

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Unsafe Dependency Resolution

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the model artifact loading...

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...

EUVD-2026-65223

GitPython: clonefrom/clone omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination...

GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...