CVE-2026-14501

CVE-2026-14501 affects IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0. The root cause is the use of potentially dangerous functions without sufficient restrictions, which could allow an attacker to execute arbitrary code or obtain sensitive information. According to the CVSS v3.1 metri...

EUVD-2026-45305

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

CVE-2026-12693

The CVE-2026-12693 entry concerns an Identity/Authorization weakness in Vimesoft Inc.'s Enterprise Video Platform. Affected software: Enterprise Video Platform versions 3.11.0.0 up to, but not including, 3.25.0. The issue is an Authorization bypass via a User-Controlled key, leading to a lack of ...

CVE-2026-15982 Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomaticcallgoogleaifunction' function. This makes ...

CVE-2026-62350

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...

CVE-2026-46638

A flaw was found in Twig, a template language for PHP. A security vulnerability exists where a template included within a restricted sandbox environment can bypass security checks if it was previously loaded without these restrictions. This allows the template to execute unauthorized functions,...

CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with alloworigins= and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests...

CVE-2026-56400

open-webui before 0.3.14 is described as vulnerable to a cross-origin resource sharing misconfiguration that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. The result is remote code execution by crafting malicious cross-site requests from ...

EUVD-2026-44629

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with alloworigins= and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests...

EUVD-2026-44581

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2kdecoderimpl::invoke, invokelinebased, invokelinebasedstream, and invokelinebasedpredecoded function in source/core/interface/decoder.cpp...

The vulnerability of the Python programming language’s pip module, related to the inclusion of functions from an unreliable and uncontrolled area, allows a perpetrator to execute arbitrary code.

The vulnerability of the Python programming language’s pip module is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

JLSEC-2026-709

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions sp256mul9, sp256sqr9, etc., leading to a timing...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the buildPodLogOpts and defaultGetPodLogs functions. An attacker can cause the server to exhaust available memory and terminate unexpectedly by sending a crafted request with unbounded limitBytes or tailLines...

CVE-2026-51808

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2kdecoderimpl::invoke, invokelinebased, invokelinebasedstream, and invokelinebasedpredecoded function in source/core/interface/decoder.cpp...

CVE-2026-51808

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2kdecoderimpl::invoke, invokelinebased, invokelinebasedstream, and invokelinebasedpredecoded function in source/core/interface/decoder.cpp...

PYSEC-2026-2373 Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...

PYSEC-2026-3206 TensorFlow has segmentation fault in tfg-translate

Impact Out-of-bounds access due to mismatched integer type sizes in ValueMap::Manager::GetValueOrCreatePlaceholder. Bug with tfg-translate call to InitMlir. The problem happens with generic functions, as it is already handled for non-generic functions. This is because they, unlike non-generic...

CVE-2026-15557

CVE-2026-15557 affects waooAI waoowaoo up to version 0.4.1. The vulnerability resides in the Internal Task Header Handler’s API-auth logic (functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, requireProjectAuthLight in src/lib/api-auth.ts). Malicious manipulatio...

ROS-20260713-73-0006

The vulnerability of the File.ReadDir and File.Readdir functions in the Go programming language is related to improper restrictions on the path to a limited directory. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...

Malicious code in pipspeed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1037d713fe94f92e9f1302a1c8fdfcd03ee290e1f2076e7c01cbd1305499e91 The package's advertised public entry point pipspeed.optimize GETs a JSON document from https://www.jsonkeeper.com/b/53XMN an anonymous, mutable past...