PT-2026-126373

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

PT-2026-127750

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

PT-2026-126411

A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended t...

PT-2026-126413

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional guests field when guests are disallowed. Attackers can set additional guests to the remaining seat count in modules/events/events...

ROS-20261027-73-0088

The EaxDecrypt function vulnerability in Wireshark’s computer network traffic analyzer is related to a buffer overflow in dynamic memory. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

VulnCheck KEV: CVE-2024-47167

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

VulnCheck KEV: CVE-2026-7467

The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported...

VulnCheck KEV: CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-117507: Concurrent Execution using Shared Resource with Improper Synchronization

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the pat...

Alpine Linux: CVE-2026-109088: Infinite Loop

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

PT-2026-125888

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-93865: Missing Authentication for Critical Function

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...

Linux Distros Unpatched Vulnerability : CVE-2026-98911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This i...

PT-2026-127227

Name of the Vulnerable Software and Affected Versions opentelemetry-propagator-jaeger versions prior to 1.45.0 Description The JaegerPropagator.extract function in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without enforcing entry, per-entry byte, or total-byte...

PT-2026-127223

Name of the Vulnerable Software and Affected Versions MLflow versions 3.10.0 through 3.16.1 Description An issue exists where a remote caller can read arbitrary files from the server filesystem with the privileges of the server process. This occurs because the prompt branch in the create model...

PT-2026-127224

Name of the Vulnerable Software and Affected Versions MLflow versions 2.19.0 through 3.16.x Description MLflow leaks CrewAI LLM provider API keys into trace telemetry when mlflow.crewai.autolog is enabled. The issue occurs because MLflow serializes the dict of CrewAI Agent objects and converts...

PT-2026-127225

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0 through 3.16.x Description Third-party scorer deserialization in mlflow/genai/scorers/base.py allows the import of request-selected descendants of allowed modules rather than requiring an exact match. An attacker can use...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146144)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146144 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before...

TencentOS Server 4: expat (TSSA-2026:1196)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1196 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...