MAL-2026-17926 Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-103091

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are vulnerable to Missing Authorization (CWE-862) and Insecure Default (CWE-1188) . The issue originates in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and the OIDC registration flow (GET /info and POST /regist...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-102503

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 CTF Challenge 배포 정보 | 항목 | 값 | |------|---...

Linux Distros Unpatched Vulnerability : CVE-2026-16487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned...

CVE-2026-111915: Improper Limitation of a Pathname to a Restricted Directory

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

Amasty Order Attributes 3.16.0 Arbitrary File Upload

Amasty Order Attributes versions through version 3.16.0 contain an unauthenticated arbitrary file upload vulnerability. This proof of concept uploads supplied HTML content or, in full mode, PHP web shells. https://packetstorm.news/download/236358...

PT-2026-117639

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2025-10149: Improper Preservation of Permissions

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

PT-2026-117464

Name of the Vulnerable Software and Affected Versions docTR versions prior to 1.1.1 Description An unsafe deserialization issue exists in the load pretrained params function. The function uses torch.load to load checkpoints without setting the weights only=True parameter. This allows an attacker...

PT-2026-117234

Name of the Vulnerable Software and Affected Versions bootc affected versions not specified Description An issue exists when using the default containers signature policy. During automatic or manual upgrades of a mutable image tag, unsigned content may be applied for registries that fall through ...

WS-2026-0171

OpenCode 1.0.137 through 1.18.32 and 2.0.0 through 2.0.17 pass the OAuth authorization URL returned by a remote MCP server to the 'open' package 10.1.2 without validation. On Windows and WSL, 'open' 10.1.2 embeds the URL unescaped in a PowerShell command, so a malicious or compromised MCP server...

ALSA-2026:84583 Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafte...

RHEL 9 : webkit2gtk3 (RHSA-2026:84583)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84583 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in...

Red Hat: CVE-2026-112258: gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

PT-2026-117249

Name of the Vulnerable Software and Affected Versions HPE Compute Scale-up Server 3200 affected versions not specified HPE Compute Scale-up Server 3250 affected versions not specified HPE Superdome Flex affected versions not specified HPE Superdome Flex 280 affected versions not specified...

PT-2026-117638

Name of the Vulnerable Software and Affected Versions Dell Application Store versions prior to 26.05.0.7 Description An Uncontrolled Path Element issue exists where a low privileged attacker with local access could potentially exploit the flaw to achieve Elevation of Privilege and execute arbitra...