CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

CVE-2026-113694 Improper Authorization in BMC ITSM SmartIT Attachments

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users...

CVE-2026-113694

The BMC IT Service Management Suite versions 25.3.01 , 25.4.01 , and 26.1.01 contain an improper authorization vulnerability within the SmartIT user attachment feature. This flaw allows authenticated users to unauthorizedly access or modify attachment resources belonging to other users. No specif...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

LangGraph JavaScript custom authentication may permit cross-user Store access

Summary LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required...

CVE-2026-118668

The langgraph-api library (versions 0.1.2 through 0.15.0 ) contains a vulnerability where JavaScript or TypeScript custom authentication handlers can return a rewritten namespace that fails to carry across the runtime boundary. This allows an authenticated user to bypass isolation and access anot...

CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

EUVD-2026-112487

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects vulnerability discovered by ? in WordPress npm undici versions = 7.0.0, 7.30.1...

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Impact When an originless Agent composes the redirect and cache interceptors as composeredirect, cache with a shared cache type: 'shared', the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored...

RHEL 10 : sssd (RHSA-2026:77534)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77534 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It...

SUSE CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

DEBIAN-CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-113496 Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-113496

A vulnerability exists in cockpit-machines where VNC console passwords are disclosed via command-line arguments. When saving settings, the software passes the password directly to an underlying system utility. A local unprivileged attacker capable of cross-user process inspection can read this pa...

EUVD-2026-104959

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

PT-2026-118346

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...