CVE-2026-67618 marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

AZL-92051 CVE-2026-59999 affecting package openssh for versions less than 9.8p1-9

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...