CVE-2026-108263

Astron Agent , an agentic workflow platform, is vulnerable to cross-tenant Remote Code Execution (RCE) in versions prior to 1.1.2 . The root cause lies in the LocalExecutor within core/workflow/engine/nodes/code/code_node.py, which is selected by default via the /console-api/workflow/code/run and...

CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-50112: Improper Neutralization of Special Elements used in an OS Command

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-2473: Generation of Predictable Numbers or Identifiers

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to but not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictabl...