PT-2026-127750

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

PT-2026-126413

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional guests field when guests are disallowed. Attackers can set additional guests to the remaining seat count in modules/events/events...

PT-2026-125888

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

PT-2026-127227

Name of the Vulnerable Software and Affected Versions opentelemetry-propagator-jaeger versions prior to 1.45.0 Description The JaegerPropagator.extract function in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without enforcing entry, per-entry byte, or total-byte...

PT-2026-127223

Name of the Vulnerable Software and Affected Versions MLflow versions 3.10.0 through 3.16.1 Description An issue exists where a remote caller can read arbitrary files from the server filesystem with the privileges of the server process. This occurs because the prompt branch in the create model...

PT-2026-126662

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this...

PT-2026-127224

Name of the Vulnerable Software and Affected Versions MLflow versions 2.19.0 through 3.16.x Description MLflow leaks CrewAI LLM provider API keys into trace telemetry when mlflow.crewai.autolog is enabled. The issue occurs because MLflow serializes the dict of CrewAI Agent objects and converts...

CVE-2026-102816: Missing Authentication for Critical Function

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

PT-2026-126637

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load pretrained gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight map causes path traversal...

PT-2026-126320

OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02 through...

ROS-20261027-73-0088

The EaxDecrypt function vulnerability in Wireshark’s computer network traffic analyzer is related to a buffer overflow in dynamic memory. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-117510: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.4:CLSA-2026:1793098772)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793098772 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146278)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146278 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix oops for port-pm on uartchangepm Unloading a hardware specific 8250 driver can...

PT-2026-125899

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode membership check facebook user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard with...

PT-2026-125552

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq file number from hash function that allows attackers to read heap memory via unchecked block table index values. Attackers can place a crafted .mpq archive in the game's data path, such as a...

PT-2026-126636

A vulnerability was detected in crownpku Rasa NLU Chi up to 0.12.2. Affected is the function Persistor. decompress of the file rasa nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may...

PT-2026-125543

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

PT-2026-126323

Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02 throug...

Silent Blindness: Fault Vulnerability of Hardware Malware Detectors

Hardware malware detectors HMDs classify hardware performance-counter measurements to identify malicious execution. Faults in their decision logic or parameters can weaken detection and allow malware to be classified as benign. We investigate this vulnerability through structural fault injection...