PT-2026-79128

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description A race condition in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to open a specially crafted HTML page. A race condition...

aphrodite-engine (>=0.6.0, <=0.6.2), autodatagen (0.0.1) +3 more potentially affected by CVE-2026-9856 via transformers (4.44.1)

transformers PYPI version 4.44.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aphrodite-engine =0.6.0, =0.8.12, =1.0.5, =1.0.9 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2026-9856 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

artificial-detection (0.1.0), benchformer (0.0.1.dev1) +1 more potentially affected by CVE-2026-9856 via transformers (4.12.3)

transformers PYPI version 4.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - artificial-detection 0.1.0 - benchformer 0.0.1.dev1 - tai-chi-engine =0.0.4, =0.0.6 Source cves: CVE-2026-9856 Source advisory:...

MariaDB: Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables

A stack buffer overflow vulnerability was identified in the CONNECT storage engine. The vulnerability existed in a function that converts character data to double-precision floating-point values. When reading DOUBLE columns from DOS table files, the function copied data into a 64-byte buffer but...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.2), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.2) +20 more potentially affected by CVE-2026-67356 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.2)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.2 and more Source cves: CVE-2026-67356 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67340 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67340 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67341 Source advisory:...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67344 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67344 Source advisory:...

CVE-2026-15988

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

PT-2026-67088

Name of the Vulnerable Software and Affected Versions The AI Engine – The Chatbot, AI Framework & MCP for WordPress versions prior to 3.6.6 Description A Cross-Site Request Forgery CSRF issue exists due to missing or incorrect nonce validation in the reauth for authorize function. This allows...

CVE-2026-67340: Improper Control of Generation of Code

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-15988: Cross-Site Request Forgery (CSRF)

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...

PT-2026-88701

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A race condition in V8, the open-source JavaScript and WebAssembly engine, allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to open a special...

Securekit — Updated!

Securekit Securekit protects what your models execute—across any AI system. Securekit is a protocol-agnostic security kernel for AI tool execution. It sits between any LLM or agent system and the tools they use, enforcing zero-trust execution, sandbox isolation, and policy-driven control. It is...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...