CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-73268

The CVE-2026-73268 entry concerns the cluster-curator-controller component of multicluster engine (MCE). A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification via spec.install.overrideJob, because CreateJob() does not validate user-controlle...

EUVD-2026-57442

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-0292

creationtimestamp| type| source ---|---|--- 2026-08-12 19:03:28+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3msvsz34hf32y 2026-08-13 04:53:05+00:00| seen| https://bsky.app/profile/samilaiho.com/post/3mswtxd7e4k27 2026-08-13 10:21:24+00:00| seen|...

CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

CVE-2026-16907

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

CVE-2026-16860

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialize. An attacker can execute arbitrary code by supplying a crafted serialized blob that causes the import and invocation of malicious callables. This can be exploited by a DAG author...

CVE-2026-16907

IBM i bulletin CVE-2026-16907 affects IBM i 7.3–7.6 (5770-SS1) and describes a remote authenticated code execution vulnerability in the Debug Server caused by improper bounds checking. Affected releases: 7.6, 7.5, 7.4, and 7.3. Impact per the CVSS: Confidentiality Low, Integrity High, Availabilit...

CVE-2026-16907 IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

EUVD-2026-57387

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

EUVD-2026-57384

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write...

EUVD-2026-57379

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...

CVE-2026-73325

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with weightsonly=False,...

CVE-2026-67260

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

CVE-2026-64639

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-68443

A flaw was found in the Linux kernel's gigabytewaterforce hwmon driver. A race condition exists because hidhwstop does not properly stop device I/O. This can occur during a driver probe failure after I/O has been initiated, leading to a Use-After-Free UAF vulnerability. An attacker could...

CVE-2026-73325

CVE-2026-73325 concerns Fujitsu Research’s OneCompression library 1.2.0, where an unsafe deserialization vulnerability arises when loading a crafted model.pt checkpoint. The root cause is QuantizedModelLoader.load_quantized_model_pt() unconditionally calling torch.load with weights_only=False, wh...

CVE-2026-73325

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with weightsonly=False,...