com.hazelcast:hazelcast-client (3.3-ea2), com.hazelcast:hazelcast-cloud (3.3-ea2) +9 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.3-ea2)

com.hazelcast:hazelcast MAVEN version 3.3-ea2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.3-ea2 - com.hazelcast:hazelcast-cloud 3.3-ea2 -...

com.hazelcast:hazelcast-client (3.3.2), com.hazelcast:hazelcast-cloud (3.3.2) +8 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.3.2)

com.hazelcast:hazelcast MAVEN version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.3.2 - com.hazelcast:hazelcast-cloud 3.3.2 - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-client (3.3.5), com.hazelcast:hazelcast-cloud (3.3.5) +12 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.3.5)

com.hazelcast:hazelcast MAVEN version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.3.5 - com.hazelcast:hazelcast-cloud 3.3.5 - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-all (1.9.4), com.hazelcast:hazelcast-client (1.9.4) +18 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (1.9.4)

com.hazelcast:hazelcast MAVEN version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 1.9.4 - com.hazelcast:hazelcast-client 1.9.4 - com.hazelcast:hazelcast-cloud 1.9.4 -...

com.hazelcast:hazelcast-all (1.9.4.3), com.hazelcast:hazelcast-client (1.9.4.3) +5 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (1.9.4.3)

com.hazelcast:hazelcast MAVEN version 1.9.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 1.9.4.3 - com.hazelcast:hazelcast-client 1.9.4.3 - com.hazelcast:hazelcast-cloud...

com.hazelcast:hazelcast-all (2.0-rc1), com.hazelcast:hazelcast-client (2.0-rc1) +5 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (2.0-rc1)

com.hazelcast:hazelcast MAVEN version 2.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 2.0-rc1 - com.hazelcast:hazelcast-client 2.0-rc1 - com.hazelcast:hazelcast-cloud...

com.hazelcast:hazelcast-all (2.1.1), com.hazelcast:hazelcast-client (2.1.1) +5 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (2.1.1)

com.hazelcast:hazelcast MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 2.1.1 - com.hazelcast:hazelcast-client 2.1.1 - com.hazelcast:hazelcast-cloud 2.1.1 -...

CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107830

The Jivejdon software (from commit e0306088 through ee67a65e ) is vulnerable to a missing rate limiting issue on the unauthenticated /account/smsVRAction endpoint. This endpoint is handled by SmsQQAction , and the lack of restrictions allows for unlimited SMS sending. An attacker can first load n...

GO-2026-6665 vulnerabilities

Vulnerabilities for packages: nrdot-collector, grafana-alloy, google-cloud-otel-ops-collector, grafana-alloy-fips...

buildbot-badges (>=1.7.0, <=1.8.2), no-cloud (0.0.8) potentially affected by CVE-2026-107378 via cairosvg (1.0.22)

cairosvg PYPI version 1.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - buildbot-badges =1.7.0, =1.8.2 - no-cloud 0.0.8 Source cves: CVE-2026-107378 Source advisory: OSV:GHSA-C3JG-QH8M-J3H2...

Security Bulletin: IBM Cloud Pak System is affected by vulnerability [CVE-2026-13463]

Summary Vulnerabilities was addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-13463 DESCRIPTION: IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files. CWE:CWE-798: Use of...

GHSA-VMXC-H2X2-JMF3 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

The Pydantic AI Python agent framework is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 through 1.107.5 and 2.44.0. When users opt-in to local network access via FileUrl (with force_download='allow-local') or web_fetch_tool (with allow_local_urls=True), an attacker can bypas...