CVE-2026-54275 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54276 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-9X8Q-7H8H-WCW9 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-XCGM-R5H9-7989 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54274 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54277 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54279 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54280 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-G3CQ-J2XW-WF74 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

CVE-2026-54278 vulnerabilities

Vulnerabilities for packages: airflow-core, authentik, airflow, metaflow-service-fips, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, py3-vllm-cuda-13.0, dask-kubernetes-fips, lmcache-cuda-12.8, mlflow-fips, open-webui, mlflow, authentik-fips,...

GHSA-537C-GMF6-5CCF vulnerabilities

Vulnerabilities for packages: airflow-core, localstack, semgrep, barman, kserve, pgadmin4, openstack-horizon-2025.2, dbt-bigquery, kubeflow-volumes-web-app, authentik, airflow, openstack-glance-2026.1, apache-beam-python-3.13-sdk, pgadmin4-fips, openstack-nova-2025.1, jupyter-base-notebook,...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

objdump-dlx-calc-poc

objdump dlx calc poc Small repro for an objdump -g crash-to...

Alibaba Cloud Linux 3 : 0159: poppler (ALINUX3-SA-2026:0159)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0159 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-10118: A flaw was found in Poppler's Splas...

Prototype Pollution

Overview i18next-fs-backend is an i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Affected versions of this package are vulnerable to Prototype Pollution via the getLastOfPath method. An attacker can modify global object...

CVE-2026-48713

CVE-2026-48713 affects i18next-fs-backend prior to 2.6.6. The issue arises when crafted missing-key strings are persisted via missingKeyHandler, where Backend.writeFile() splits keys on keySeparator and the path walker could reach Object.prototype (e.g., a key like "proto .polluted"), allowing pr...

CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input. Backend.writeFile splits each queued missing-key string on the configured...

CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input. Backend.writeFile splits each queued missing-key string on the configured...

CVE-2026-48713 i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input. Backend.writeFile splits each queued missing-key string on the configured...