com.hazelcast:hazelcast-build-utils (3.6.8), com.hazelcast:hazelcast-client (3.6.8) +15 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.6.8)

com.hazelcast:hazelcast MAVEN version 3.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-build-utils 3.6.8 - com.hazelcast:hazelcast-client 3.6.8 -...

com.hazelcast:hazelcast-client (3.4-ea), com.hazelcast:hazelcast-cloud (3.4-ea) +6 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.4-ea)

com.hazelcast:hazelcast MAVEN version 3.4-ea is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.4-ea - com.hazelcast:hazelcast-cloud 3.4-ea - com.hazelcast:hazelcast-hibernate...

CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107830

The Jivejdon software (from commit e0306088 through ee67a65e ) is vulnerable to a missing rate limiting issue on the unauthenticated /account/smsVRAction endpoint. This endpoint is handled by SmsQQAction , and the lack of restrictions allows for unlimited SMS sending. An attacker can first load n...

GO-2026-6665 vulnerabilities

Vulnerabilities for packages: google-cloud-otel-ops-collector, grafana-alloy-fips, nrdot-collector, grafana-alloy...

buildbot-badges (>=1.7.0, <=1.8.2), no-cloud (0.0.8) potentially affected by CVE-2026-107378 via cairosvg (1.0.22)

cairosvg PYPI version 1.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - buildbot-badges =1.7.0, =1.8.2 - no-cloud 0.0.8 Source cves: CVE-2026-107378 Source advisory: OSV:GHSA-C3JG-QH8M-J3H2...

Security Bulletin: IBM Cloud Pak System is affected by vulnerability [CVE-2026-13463]

Summary Vulnerabilities was addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-13463 DESCRIPTION: IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files. CWE:CWE-798: Use of...

GHSA-VMXC-H2X2-JMF3 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107289

The Pydantic AI Python agent framework is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 through 1.107.5 and 2.44.0. When users opt-in to local network access via FileUrl (with force_download='allow-local') or web_fetch_tool (with allow_local_urls=True), an attacker can bypas...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-12859

Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not...

Security Bulletin: Multiple Vulnerabilities affect IBM Cloud Pak System

Summary Multiple Vulnerabilities have been addressed in IBM Cloud Pak System v2.3.5.1. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern...

CVE-2026-12859 IDOR in Caz Informatics' Advancity ALMS Cloud

Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not...

CVE-2026-12859 IDOR in Caz Informatics' Advancity ALMS Cloud

Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not...

CVE-2026-12859

A Missing Authorization (CWE-862) vulnerability exists in Caz Informatics Services Trade Inc. Advancity ALMS Cloud . The flaw allows an attacker to access functionality that is not properly constrained by Access Control Lists (ACLs). This issue affects the product through 2026-10-08 . The CVSS v3...