org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +36 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-components (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-components MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875411...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-bom (>=2.4.0, <=2.8.0) +55 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-authorization (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-authorization MAVEN version =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m2, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.8.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875409...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +27 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-core (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875414...

org.apache.nifi:nifi-framework-kubernetes-nar (>=2.0.0-m3, <=2.0.0), org.apache.nifi:nifi-framework-nar (>=2.0.0-m3, <=2.0.0) +13 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-cluster (>=2.0.0-m1, <=2.0.0)

org.apache.nifi:nifi-framework-cluster MAVEN version =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m1, =2.0.0-m4, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m4 - org.apache.nifi:nifi-web-error 2.0.0-m3 - org.apache.nifi:nifi-web-frontend 2.0.0-m3 -...

Missing Authorization

Overview org.apache.nifi:nifi-framework-cluster is a clustering software for NiFi. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

Missing Authorization

Overview org.apache.nifi:nifi-framework-core is a system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-bom (>=2.4.0, <=2.8.0) +54 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-core-api (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-core-api MAVEN version =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m2, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.8.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875412...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

windows7-eternalblue-exploit-lab

EternalBlue MS17-010 Exploitation Lab — Windows 7 A hands-o...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

PT-2026-51389

Name of the Vulnerable Software and Affected Versions Filament versions prior to 3.3.52 Filament versions prior to 4.11.5 Filament versions prior to 5.6.5 Description Filament applies Livewire's WithFileUploads trait to components where schemas may contain file upload fields. Certain schemas, suc...

PixJail: Self-Evolving Paper-To-Pipeline Reproduction for Text-To-Image Jailbreak Evaluation

As Text-to-Image T2I jailbreak techniques evolve rapidly, existing benchmarks and reproduction workflows often struggle to keep pace. More importantly, T2I jailbreak evaluation is not a single prompt-level test, but a pipeline-level problem shaped by multiple stages, including prompt...

CVE-2026-53663: Cross-Site Request Forgery (CSRF)

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...

PT-2026-51387

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.11.4 Filament versions 5.0.0 through 5.6.4 Description The login page contains a timing discrepancy that enables unauthenticated attackers to perform email enumeration. This allows an attacker to determine if ...

NVIDIA NeMo Framework arbitrary code execution vulnerability

NVIDIA NeMo Framework is an open-source generative AI development platform designed specifically for researchers and developers. It aims to efficiently build, customize, and deploy large language models, multimodal models, and voice AI models. The NVIDIA NeMo Framework has a code execution...

PT-2026-51388

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.11.5 Filament versions prior to 5.6.5 Description The ImageColumn and ImageEntry components render raw database values without escaping HTML. If the data passed to these components is not validated, an attacker can...

What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security

Modern software development relies heavily on third-party components from public repositories, expanding the software supply chain attack surface. In response to these growing risks, federal initiatives have advanced the Software Bill of Materials SBOM as a standardized mechanism for improving...

Understanding the Stealthy BGP Hijacking Risk in the ROV Era

The partial deployment of Route Origin Validation ROV poses an unexpected security threat known as stealthy BGP hijacking, i.e., a particularly elusive form of BGP hijacking where malicious routes divert traffic without reaching and thus alerting the victims. This risk remains largely unexplored,...

CVE-2026-56448: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to resolve outside the intended image,...

RHEL 10 : .NET 9.0 (RHSA-2026:28009)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28009 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...