CVE-2026-53715

A flaw was found in Envoy Gateway. Improper synchronization in the Wasm cache handling allows an attacker with pod-network access and tenant permissions to trigger a race condition. By flooding GET requests, an attacker can cause a read-write overlap, leading to the termination of the controller...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

PYSEC-2026-4174 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

Exploit for CVE-2026-100671

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal...

CVE-2026-103004

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

EUVD-2026-90872

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004

Next.js versions 16.3.0 to 16.3.7 are vulnerable to a cache leak when use cache handlers access next/root-params with Cache Components enabled. The root cause is an incorrect cache key generation: if an inner use cache function reads a root param and is served from an existing entry, the enclosin...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

WordPress Cache Enabler plugin < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion vulnerability

Unauthenticated Arbitrary File and Directory Deletion vulnerability discovered by Jakub Herman in WordPress Plugin Cache Enabler versions 1.8.17...

CVE-2026-96577

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577

A vulnerability exists in oc-mirror (specifically identified in release-4.21 ) where the embedded local cache registry binds to all network interfaces during mirroring operations. The service lacks authentication and encryption , failing to restrict access to the local system. An unauthenticated ...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

EUVD-2026-90590

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CLEANSTART-2024-EL38681 libfreerdp/cache/bitmap

Security vulnerability affects the freerdp package. libfreerdp/cache/bitmap...

CVE-2026-19253

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

EUVD-2026-90508

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...