PT-2026-127227

Name of the Vulnerable Software and Affected Versions opentelemetry-propagator-jaeger versions prior to 1.45.0 Description The JaegerPropagator.extract function in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without enforcing entry, per-entry byte, or total-byte...

PT-2026-127223

Name of the Vulnerable Software and Affected Versions MLflow versions 3.10.0 through 3.16.1 Description An issue exists where a remote caller can read arbitrary files from the server filesystem with the privileges of the server process. This occurs because the prompt branch in the create model...

PT-2026-127225

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0 through 3.16.x Description Third-party scorer deserialization in mlflow/genai/scorers/base.py allows the import of request-selected descendants of allowed modules rather than requiring an exact match. An attacker can use...

Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Posted by Samuel Groß Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep...

CVE-2026-117511: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

Linux ionic_qcqs_free Heap Buffer Overflow DoS

The vulnerability in the ionicqcqsfree function within the drivers/net/ethernet/pensando/ionic/ioniclif.c component of the Linux kernel is related to an improper thread management implementation. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Docker Hub Privilege Escalation

The vulnerability in the Docker Hub cloud storage account conversion function is related to access control flaws. Exploitation of this vulnerability could allow a remote attacker to escalate their privileges...

CVE-2026-117510: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-118128: a2aproject a2a-js: A vulnerability has been found in a2aproject a2a-js up to 1.1.0

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the inetdelifa function within the net/ipv4/devinet.c component of the Linux kernel operating system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

CVE-2026-117515: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146148 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aareplaceprofiles The function aareplaceprofiles was accessing...

CentOS Linux 8.4 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793102654)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793102654 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the cfg80211leaveocb function within the net/wireless/ocb.c component of the Linux kernel operating system is related to improper thread management implementation. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

CentOS Linux 8 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793091465)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793091465 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the libra...

CentOS Linux 8.5 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1793103045)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793103045 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

Linux GPU DRM XE HW Engine Heap Buffer Overflow DoS

The vulnerability in the hwengineinit function within the drivers/gpu/drm/xe/xehwengine.c component of the Linux kernel system is related to improper thread management implementation. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and...

Linux Distros Unpatched Vulnerability : CVE-2026-116620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library...

Linux Distros Unpatched Vulnerability : CVE-2026-116195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after...

PT-2026-126662

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this...