CVE-2026-44102

CVE-2026-44102 affects an OCPP backend firmware download workflow. An unauthenticated remote attacker can supply an invalid firmware file to trigger a download, leaving the file accessible for a short period before cleanup deletes it due to improper locking. This can result in brief exposure of t...

Important: Red Hat Security Advisory: hplip security, bug fix, and enhancement update

An update for hplip is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-64407

A flaw was found in the Linux kernel's Bluetooth driver. A malicious Bluetooth controller could send a specially crafted firmware download request that causes an out-of-bounds read. This allows the driver to read memory beyond the intended firmware data and send it back over the Universal...

DEBIAN-CVE-2026-17711

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17711

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-46678

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-46678

Pydantic AI CVE-2026-46678 affects versions 1.56.0–1.98.0 where force_download='allow-local' on a URL influenced by untrusted input can bypass the cloud-metadata blocklist using IPv6 transition forms (IPv4-mapped IPv6, 6to4, NAT64, NAT64/isatap variants). The issue is mitigated by upgrading to 1....

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

EUVD-2026-50561

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-67429

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429

Flyto2 Core (execution kernel for automation/AI-agent workflows) contains an Arbitrary File Write vulnerability in image.download and related file-writing modules prior to version 2.26.6. The root cause is caller-controlled output_dir, which bypasses validate_path_with_env_config and FLYTO_SANDBO...

CVE-2026-13346

Pip has a vulnerability (CVE-2026-13346) where doubly-encoded package URLs from indexes can lead to files being installed to arbitrary locations on disk, even when installing wheels. The issue is exploitable only when downloading/installing from a malicious package index; malicious packages alone...

GHSA-F42X-P2MX-HM8R Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

CVE-2026-11974

The vulnerability is in the wp-media-folder-addon WordPress plugin up to version 4.1.6. It does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions accessible to unauthenticated users, enabling Arbitrary File Disclosure and Server-Side Request Forge...

PT-2026-65896

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows...

CVE-2026-54719

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...