CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-65126

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

CVE-2026-65126

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

CVE-2026-65126

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

EUVD-2026-84412

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

CVE-2026-65126

The NVIDIA Infrastructure Controller for Linux is affected by CVE-2026-65126 , which involves the improper enforcement of a behavioral workflow (CWE-841). A successful exploit could result in data tampering , denial of service , and information disclosure . This vulnerability affects versions 0 t...

CVE-2026-65178

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-65178

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-65178

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

EUVD-2026-84405

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-95658

CVE-2026-95658 affects MISP , where the moduleStatelessExecution action in the WorkflowsController was listed in the CakePHP Security component's unlockedActions list, disabling both the CSRF token check and field hash validation . An attacker could craft a cross-site form post that, when submitt...

CVE-2026-76804: Improper Access Control

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-65126: Improper Enforcement of Behavioral Workflow

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

PT-2026-96717

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The WorkflowsController exposes the moduleStatelessExecution action within the Security component's unlockedActions list. In the CakePHP framework, including an action in unlockedActions disables field...

PT-2026-96835

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The workflow template loading path fails to enforce the -file capability gate when resolving templates using the file: protocol referenced by a workflow. This allows an untrusted, unsigned workfl...

PT-2026-96749

Name of the Vulnerable Software and Affected Versions NVIDIA Infrastructure Controller for Linux affected versions not specified Description An issue exists where an attacker could cause improper enforcement of a behavioral workflow. This could lead to data tampering, denial of service, and...

CVE-2026-65178: Deserialization of Untrusted Data

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

PT-2026-97111

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description The firmware contains a hardcoded, undocumented recovery account with shared credentials that cannot be modified, disabled, or rotated. An unauthenticated remot...