EUVD-2026-112816

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-119050

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-113691 Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers...

CVE-2026-48196 WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27...

CVE-2026-113690 Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

EUVD-2026-112806

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

CVE-2026-113690

The BMC IT Service Management Suite versions 25.3.01 , 25.4.01 , and 26.1.01 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the SmartIT attachment feature . This flaw allows authenticated users to upload malicious script content that can be executed in the browsers of othe...

flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...

flatpak: Flatpak: Arbitrary code execution via missing symlink protection

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability (CVE-2026-10859)

Summary IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability due to insecure deserialization of ObjectMessage payloads Vulnerability Details CVEID:CVE-2026-10859 DESCRIPTION: IBM MQ XMS .NET client could allow an authenticated attacker to execute arbitrary code on...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-10572)

Summary IBM MQ has addressed a denial of service vulnerability due to a heap buffer overflow when processing MQPUT operations with malformed message options Vulnerability Details CVEID:CVE-2026-10572 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-10574)

Summary IBM MQ has addressed a denial of service vulnerability due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties Vulnerability Details CVEID:CVE-2026-10574 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial o...

Security Bulletin: IBM MQ is affected by an arbitrary code execution vulnerability (CVE-2026-12665)

Summary IBM MQ has addressed an arbitrary code execution vulnerability due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment Vulnerability Details CVEID:CVE-2026-12665 DESCRIPTION: IBM MQ could allow a remote...

CVE-2022-21974

CVE-2022-21974: Unitialized pointer free in RMSRoamingSecurity Remote Code Execution Root-cause The RMSRoamingSecurity!ATL::CComCreator ::CreateInstance constructor allocates and initializes a CRmsRoamingSecurity object 0x3470 bytes but it fails to initialize completely its state. For example, at...

Security Bulletin: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability (CVE-2026-12356)

Summary IBM MQ Managed File Transfer has addressed an arbitrary code execution vulnerability caused by injecting malicious arguments into Ant script commands. Vulnerability Details CVEID:CVE-2026-12356 DESCRIPTION: IBM MQ Managed File Transfer could allow an authenticated user with command queue...

Security Bulletin: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability (CVE-2026-13292)

Summary IBM MQ Managed File Transfer has addressed an arbitrary code execution vulnerability Vulnerability Details CVEID:CVE-2026-13292 DESCRIPTION: IBM MQ Managed File Transfer could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-12148)

Summary IBM MQ is affected by a denial of service vulnerability due to unrestricted Java deserialization in the MQ Classes for Java Vulnerability Details CVEID:CVE-2026-12148 DESCRIPTION: IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute...

openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Java Generic Security Services JGSS component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure...