CVE-2026-18617 Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

A flaw was found in the Data Science Pipelines Operator DSPO. A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name DSN string. By manipulating these parameters, an attack...

CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033

CVE-2026-73033 affects the Sucuri Security WordPress plugin up to version 2.7.3. A path traversal flaw exists in the pageIntegritySubmission() function (src/integrity.lib.php) that lets authenticated administrators delete arbitrary files by supplying directory traversal sequences via the sucurisc...

EUVD-2026-55803

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +25 more potentially affected by CVE-2026-18947 via feast (>=0.9.3, <=0.65.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 - mlops-ods 0.1.202406281646 and more Source cves: CVE-2026-18947 Source advisory: SNYK:PYTHON-FEAST-18612610...

CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72869

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...

DEBIAN-CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

PYSEC-2026-3713

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

PYSEC-2026-3713

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

UBUNTU-CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +25 more potentially affected by CVE-2026-18948 via feast (>=0.9.3, <=0.65.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 - mlops-ods 0.1.202406281646 and more Source cves: CVE-2026-18948 Source advisory: SNYK:PYTHON-FEAST-18612609...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +25 more potentially affected by CVE-2026-18941 via feast (>=0.9.3, <=0.65.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 - mlops-ods 0.1.202406281646 and more Source cves: CVE-2026-18941 Source advisory: SNYK:PYTHON-FEAST-18612620...

EUVD-2026-55731

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...