CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

AZL-87546 CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87543 CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87549 CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87558 CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87561 CVE-2026-25680 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87555 CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-4

CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-4. A patched version of the package is available...

CVE-2026-32288 affecting package containerized-data-importer for versions less than 1.62.0-3

CVE-2026-32288 affecting package containerized-data-importer for versions less than 1.62.0-3. A patched version of the package is available...

AZL-86448 CVE-2026-33814 affecting package containerized-data-importer for versions less than 1.62.0-6

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

Medium: cifs-utils

Issue Overview: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentia...

CVE-2026-41268

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution RCE vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined wi...

CVE-2026-41268 Flowise: Flowise Parameter Override Bypass Remote Command Execution

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution RCE vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined wi...

AZL-85628 CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-6

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...

aws-mcp-server 操作系统命令注入漏洞

aws-mcp-server is a lightweight service developed by Alexei Ledenev. It enables AI assistants to execute AWS CLI commands through the Model Context Protocol MCP in a secure, containerized environment. aws-mcp-server has an operating system command injection vulnerability, which stems from...

AZL-82169 CVE-2026-32288 affecting package containerized-data-importer for versions less than 1.62.0-3

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format...