EUVD-2026-29748

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +130 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=3.10.0, <=3.10.5)

io.micronaut:micronaut-context MAVEN version =3.10.0, =4.5.0, =4.5.2 - dk.glasius:i18n-enums $releaseversion - hu.webarticum.miniconnect:rest 0.7.0 - io.cloudflight.testresources.springboot:springboot-testresources-azurite 0.6.0 -...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.0-micronaut-2.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-2.0, <=2.2.2-micronaut-3.0) +592 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=2.4.0, <=3.8.13)

io.micronaut:micronaut-context MAVEN version =2.4.0, =1.6.0-micronaut-2.0, =2.0.8-micronaut-2.0, =1.6.0-micronaut-2.0, =1.6.0-micronaut-2.0, =1.7.3-micronaut-2.0, =1.6.2-micronaut-2.0, =2.0.0-micronaut-2.0, =1.7.2-micronaut-2.0, =1.6.0-micronaut-2.0, =1.7.3-micronaut-2.0, =1.6.0-micronaut-2.0,...

com.c0x12c:module-ai-image (>=0.12.0, <=0.17.0), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.17.0) +669 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=4.3.0, <=4.10.21)

io.micronaut:micronaut-context MAVEN version =4.3.0, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.2.6, =0.2.5, =0.2.6, =0.5.0, =0.10.0, =0.8.0, =0.5.0, =0.17.0 - com.c0x12c:module-sqs 0.2.5 and more Source cves: CVE-2026-44241 Source advisory: MEND:CVE-2026-44241...

CVE-2026-42451

Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting XSS vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser wi...

CVE-2026-8429

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections...

CVE-2026-34682

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-34660

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially...

CVE-2026-8430

CVE-2026-8430 affects SPIP versions prior to 4.4.14. The vulnerability is a remote code execution in the public space, limited to certain nginx configurations, allowing attackers to run arbitrary code in the web server context. Exploitation relies on specific nginx configuration scenarios and is ...

CVE-2026-8429

SPIP versions prior to 4.4.14 are affected by a remote code execution vulnerability in the private space, allowing an attacker to execute arbitrary code in the web server context. Affected component: SPIP core (private space); impact is high on confidentiality, integrity, and availability as desc...

CVE-2026-8429

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections...

Extending Security to MCP Servers: Closing a Critical Gap

The Model Context Protocol MCP is a de facto standard for providing structured access to privileged systems for AI agents and external integrations. It acts as a USB-C port for AI, enabling faster innovation by allowing organizations to expose tools, resources, and workflows without the...

MINI-WVJ8-874X-RMWP

Bulletin has no description...

MINI-XJ4C-CV5P-95RP

Bulletin has no description...

MINI-5WRM-W97R-F7VJ

Bulletin has no description...

BIT-ARGO-WORKFLOWS-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

BELL-CVE-2026-41142

Bulletin has no description...

MINI-G8Q2-6M3J-H53R

Bulletin has no description...

MINI-8PF7-P5M6-4R8J

Bulletin has no description...

Malware in @uipath/context-grounding-tool

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...