Astra Linux – Vulnerability in docker.io-app

Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...

CVE-2026-13107: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

PT-2026-91461

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow affected versions not specified Description Programming model artifacts in both containerized and traditional deployments may be susceptible to XML Entity Injection attacks by default. This occurs when an...

PT-2026-91226

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

PyOD persistence.load deserializes untrusted artifacts before validation

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix thi...

PYSEC-2026-3909 PyOD persistence.load deserializes untrusted artifacts before validation

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix thi...

CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

CLEANSTART-2026-WT32301 oras-go is a Go library for managing OCI artifacts

Multiple security vulnerabilities affect the kyverno package. oras-go is a Go library for managing OCI artifacts. See references for individual vulnerability details...

CVE-2026-19583: Incorrect Permission Assignment for Critical Resource

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

irflow-timeline v1.0.13

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

Deserialization of Untrusted Data

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the machine learning component when processing trained model artifacts. An attacker can execu...

GO-2026-6294 Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy...

PYSEC-2026-3735

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability

Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts vulnerability discovered by Duy Tran in WordPress Plugin Everest Forms versions 3.5.0...

SUSE CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...