CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27770: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

CVE-2025-27771: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27772: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

PT-2026-76685

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.11 Description Unauthenticated payment webhook endpoints read and log full request bodies before performing signature validation. This occurs in router/api-router.go and the payment controllers. An...

PT-2026-76687

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.2 Description An issue exists in the /new run endpoint that allows remote code execution. Authenticated users can execute arbitrary code on the host system, typically within the Docker container, by manipulating t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: docker (UTSA-2026-050390)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-050390 advisory. Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypass...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100560)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100560 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099722 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add...

ogre:script_fuzz: Container-overflow in Ogre::TextureUnitState::_unload

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=5934574946025472 Project: ogre Fuzzing Engine: libFuzzer Fuzz Target: scriptfuzz Job Type: libfuzzerasanogre Platform Id: linux Crash Type: Container-overflow WRITE 8 Crash Address: 0x7bf5bfde0930 Cra...

Exploit for CVE-2026-73519

CVE-2026-73519 — WolfStack Hardcoded Cluster Secret → Unauthen...

GHSA-HQVF-45JJ-MCCQ vulnerabilities

Vulnerabilities for packages: localstack...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: azure-service-operator, grafana-rollout-operator, atlas, livekit-cli, kyverno-notation-aws, mattermost-fips, porch-fips, prometheus-operator, kube-conformance, harvester-fips, crossplane-provider-aws-appautoscaling, helm-mapkubeapis, beats-fips, dapr,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: argo-cd, src, trufflehog, flux-kustomize-controller, postgres-operator, sbomqs, flux-source-controller, regclient, mountpoint-s3-csi-driver, ollama, frp, gostatsd, nri-elasticsearch, seaweedfs, nfpm, terraform-provider-kubernetes, k3d, loki, pgtimetable,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: argo-cd, src, trufflehog, flux-kustomize-controller, postgres-operator, sbomqs, flux-source-controller, regclient, mountpoint-s3-csi-driver, ollama, frp, gostatsd, nri-elasticsearch, seaweedfs, nfpm, terraform-provider-kubernetes, k3d, loki, pgtimetable,...

OPENSUSE-SU-2026:11520-1 kubevirt1.9-container-disk-1.9.0-1.1 on GA media

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76446

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: nuxeo, elasticsearch-fips, airbyte-server-fips, kafka-bridge, nacos, wildfly, elasticsearch, apache-activemq-artemis, kafka-fips, solr-fips, flink-kubernetes-operator, geoserver, spdx-tools-java, strimzi-kafka-operator, airbyte-server, strimzi-kafka-operator-fips,...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: spegel, azure-service-operator, grafana-rollout-operator, prometheus-operator, kyverno-notation-aws, crane, kube-conformance, crossplane-provider-aws-appautoscaling, beats-fips, dapr, cluster-autoscaler-fips, grafana-alloy, gcp-compute-persistent-disk-csi-driver,...