mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2026-2651 via mlflow (2.13.0)

mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

kernel: can: raw: fix ro->uniq use-after-free in raw_rcv()

A flaw was found in the Linux kernel's Controller Area Network CAN raw socket implementation. A use-after-free vulnerability can occur due to a timing window during the unregistration of CAN receive filters, allowing a freed memory region to be accessed. This could lead to system instability or a...

CVE-2026-9518

The vulnerability CVE-2026-9518 affects hemant6488’s CodeIgniter-StudentManagementSystem, specifically the Students Controller function addStudent in view_students.php. The issue is cross site scripting caused by manipulating the Name argument, enabling remote exploitation. Documents indicate the...

CVE-2026-9518 hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting

A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file viewstudents.php of the component Students Controller. The manipulation of the argument Name leads to cross site scripting. The attack is possible to be...

CVE-2026-9518

A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file viewstudents.php of the component Students Controller. The manipulation of the argument Name leads to cross site scripting. The attack is possible to be...

Snipe-IT security vulnerabilities

Snipe-IT is a set of open-source IT asset/license management systems developed by Grokability. Versions of Snipe-IT prior to 8.4.1 contained security vulnerabilities. These vulnerabilities stemmed from the API controller, which only removed the superuser key from the permission array, potentially...

UBUNTU-CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

Kavita Access Control Vulnerability

Kavita is a fast and feature-rich cross-platform reading server developed by Kavita OpenSource. Versions of Kavita prior to 0.9.0 contained an access control vulnerability. This vulnerability stemmed from the ReaderController.GetImage endpoint, which allowed completely unauthenticated access,...

CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

CVE-2026-9518: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file viewstudents.php of the component Students Controller. The manipulation of the argument Name leads to cross site scripting. The attack is possible to be...

Student Management System Code Injection Vulnerability

Student Management System is a student management system developed by Krishanmurariji. There is a code injection vulnerability in Student Management System. This vulnerability stems from improper handling of the Name parameter in the addStudent function of the Students Controller component, which...

mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2026-2651 via mlflow (2.13.0)

mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2026-2651 Source advisory: OSV:PYSEC-2026-2220...

FuzzPilot: Plateau-Triggered Recipe Validation for Structured Text Fuzzing

FuzzPilot is a controller for AFL++ that moves expensive reasoning out of the mutation hot path. When coverage plateaus, it snapshots the corpus, prepares candidate mutation recipes, evaluates them in short isolated AFL++ micro-campaigns, and promotes only recipes with positive validation reward...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: headlamp, kubescape, docker-cli-buildx, docker-compose, linkerd2, syft, k8sgpt, k3s, rancher, helm-set-status, kots, gogatekeeper, k9s, envoy-gateway, steampipe, eksctl, kubevela, kube-arangodb, kaniko, wolfictl, opa-envoy, helm, cluster-api-helm-controller,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: headlamp, kubescape, docker-cli-buildx, docker-compose, linkerd2, syft, k8sgpt, k3s, rancher, helm-set-status, kots, gogatekeeper, k9s, envoy-gateway, steampipe, eksctl, kubevela, kube-arangodb, kaniko, wolfictl, opa-envoy, helm, cluster-api-helm-controller,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kaniko, linkerd2-fips, buildkitd, k9s-fips, opa-fips, opa-fips-envoy, kubescape-server, scorecard, cloudbeat, xeol, envoy-gateway, kgateway, packer, neuvector, spegel, docker-cli-buildx-fips, packer-fips, google-osconfig-agent, xeol-fips,...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the star function in the backend file controller. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking them...

GHSA-QJ94-6RX6-27FR Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

Concrete CMS 9 through 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file addFavoriteFolder$id...

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

Concrete CMS 9 through 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file addFavoriteFolder$id...

EUVD-2026-31369

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file star. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Dror...