PT-2026-50495

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.21 Traefik versions prior to 3.7.5 Description An issue exists in the Kubernetes Gateway provider regarding the crossProviderNamespaces allowlist. When HTTPRoute rules declare multiple backendRefs Weighted Round...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory. It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An...

PT-2026-50538

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to commit ff45d3b Description Tinyproxy fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine the number o...

PT-2026-50524

Name of the Vulnerable Software and Affected Versions Devolutions UniGetUI versions prior to 2026.2.1 Description The pinget backend contains an issue where names or references are incorrectly resolved. This allows a WinGet community catalog contributor to correlate an installed application with ...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...

nginx -- multiple vulnerabilities

The nginx developers report: A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders off;" and "largeclientheaderbuffers" directives with large configured values while proxying a specially crafted request to an HTTP/2 or gRPC backend may allow memory corruption or a...

PT-2026-50479

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The chat message listener in the chat page's window message listener processes input:prompt and action:submit messages without enforcing same-origin restrictions. This allows an external site to s...

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...

CVE-2026-2604

Summary: CVE-2026-2604 affects evolution-data-server. An inconsistent comparison logic in the addressbook backend lets a Flatpak/D-Bus user craft a malicious URI with directory traversal sequences. This URI is stored during contact creation/modification and later rechecked with lower strictness d...

CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

CVE-2026-54283 vulnerabilities

Vulnerabilities for packages: airflow-core, semgrep, tritonserver-backend-vllm-cuda-13.0, mlflow, airflow, prefect-fips, nemo, prefect, tritonserver-backend-vllm-cuda-12.9, airflow-postgres-fips, litellm, mlflow-fips...

GHSA-82W8-QH3P-5JFQ vulnerabilities

Vulnerabilities for packages: airflow-core, semgrep, tritonserver-backend-vllm-cuda-13.0, mlflow, airflow, prefect-fips, nemo, prefect, tritonserver-backend-vllm-cuda-12.9, airflow-postgres-fips, litellm, mlflow-fips...

CVE-2026-54282 vulnerabilities

Vulnerabilities for packages: airflow-core, semgrep, tritonserver-backend-vllm-cuda-13.0, mlflow, airflow, prefect-fips, nemo, prefect, tritonserver-backend-vllm-cuda-12.9, airflow-postgres-fips, litellm, mlflow-fips...

GHSA-JP82-JPQV-5VV3 vulnerabilities

Vulnerabilities for packages: airflow-core, semgrep, tritonserver-backend-vllm-cuda-13.0, mlflow, airflow, prefect-fips, nemo, prefect, tritonserver-backend-vllm-cuda-12.9, airflow-postgres-fips, litellm, mlflow-fips...

GHSA-2FQR-MR3J-6WP8 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-63HW-FMQ6-XXG2 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-4M7W-QMGQ-4WJ5 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-HPJ7-WQ8M-9HGP vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54275 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...