BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...

PYSEC-2026-4069 BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...

PYSEC-2026-4072 BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...

PYSEC-2026-4073 LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticateuser of the file litellm/proxy/auth/loginutils.py of the component PROXYADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated...

Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

SummaryUsing idlelib.autocomplete.AutoComplete.fetchcompletions, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to...

Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

SummaryUsing torch.jit.unsupportedtensorops.execWrapper function, which is a pytorch library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to torch.jit.unsupportedtensorops.execWrapper function in...

CVE-2026-92870

A flaw was found in Pgpool-II. Due to a stack-based buffer overflow, an unauthenticated remote attacker can trigger abnormal process termination by sending specially crafted input to the server. This issue leads to a Denial of Service DoS, making the service unavailable to legitimate users...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-73636

The Apache HTTP Server 2.4.x on all platforms is vulnerable to an authentication bypass via a capture-replay attack in the mod_auth_digest module. When AuthDigestNonceLifetime is set to 0 , a man-in-the-middle (MITM) attacker can replay captured digest authentication credentials by sending crafte...

CVE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

EUVD-2026-90898

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

CVE-2026-13043

WatchGuard endpoint security products are affected by a missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) . A local, authenticated attacker can bypass the driver's access-control handshake to issue arbitrary privileged commands. This flaw allows for the disclosure o...

EUVD-2026-90888

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

Exploit for CVE-2026-100671

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal...

CVE-2026-79899

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-103687

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-103687

A vulnerability exists in rhukster dom-sanitizer up to version 1.0.15 within the SVG Sanitization component. The flaw is located in the url function of the src/DOMSanitizer.php file, where manipulation can lead to an incomplete blacklist . This issue allows for potential remote attacks , and expl...