@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +68 more potentially affected by CVE-2026-24131 via @pnpm/package-bins (>=1000.0.0, <=1000.0.16)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1002.2.0, =1002.0.11, =1003.0.27 and more Source cves: CVE-2026-24131 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15102727...

CVE-2026-22696

dcap-qvl implements the quote verification logic for DCAP Data Center Attestation Primitives. A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity,...

CVE-2026-22696 dcap-qvl has Missing Verification for QE Identity

dcap-qvl implements the quote verification logic for DCAP Data Center Attestation Primitives. A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity,...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-23889 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23889 Source advisory: OSV:GHSA-6X96-7VC8-CM3P...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +68 more potentially affected by CVE-2026-23890 via @pnpm/package-bins (>=1000.0.0, <=1000.0.15)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1002.2.0, =1002.0.11, =1003.0.26 and more Source cves: CVE-2026-23890 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15103738...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-24056 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-24056 Source advisory: OSV:GHSA-M733-5W8F-5GGW...

dcap-qvl has Missing Verification for QE Identity

Impact This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity, qeidentitysignature, and qeidentityissuerchain from the PCCS. However, it skips to verify the QE Identity signature...

@1upmonster/duel (>=0.1.0, <=0.1.8), @flash_trade/magic-trade-client (>=0.1.0, <=1.0.51) +8 more potentially affected by CVE-2026-22696 via @phala/dcap-qvl-web (>=0.2.7, <=0.3.3)

@phala/dcap-qvl-web NPM version =0.2.7, =0.1.0, =0.1.0, =0.3.6, =0.2.9, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-22696 Source advisory: OSV:GHSA-796P-J2GH-9M2Q...

GHSA-796P-J2GH-9M2Q dcap-qvl has Missing Verification for QE Identity

Impact This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity, qeidentitysignature, and qeidentityissuerchain from the PCCS. However, it skips to verify the QE Identity signature...

urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain...

Exploit for CVE-2026-22686

CVE-2026-22686 Web Application PoC Critical Sandbox Escape...

CVE-2026-24123: Improper Limitation of a Pathname to a Restricted Directory

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

PT-2026-4828

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.34 Description BentoML contains a path traversal flaw in the bentofile.yaml configuration. An attacker can craft a malicious bentofile.yaml that, when processed by BentoML, allows the exfiltration of arbitrary fil...

ALSA-2026:1086 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

SUSE CVE-2025-71160

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nftchainvalidate: watchdog: BUG: soft lockup - CPU1 stuck for 27s! iptables-nft-re:37547 .. RIP: 0010:nftchainvalidate+0xcb/0x1...

AZL-75126 CVE-2025-71160 affecting package kernel for versions less than 6.6.121.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nftchainvalidate: watchdog: BUG: soft lockup - CPU1 stuck for 27s! iptables-nft-re:37547 .. RIP: 0010:nftchainvalidate+0xcb/0x1...

AZL-78434 CVE-2025-71160 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nftchainvalidate: watchdog: BUG: soft lockup - CPU1 stuck for 27s! iptables-nft-re:37547 .. RIP: 0010:nftchainvalidate+0xcb/0x1...