1157765 matches found
Network-AI: Improper Neutralization of Special Elements used in an OS Command
Summary The agent sandbox gates shell commands behind an allowlist SandboxPolicy.isCommandAllowed, which THREATMODEL.md calls the main control against a compromised agent Adversary 3.2. The allowlist glob-matches the whole command string, but ShellExecutor runs that string through /bin/sh -c. So...
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Advisory / Disclosure Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives Target: Jovancoding/Network-AI npm network-ai, latest v5.7.1 Status: the advisory "Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret" named three flaws. The...
GHSA-R78R-RWRF-RJWP Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Advisory / Disclosure Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives Target: Jovancoding/Network-AI npm network-ai, latest v5.7.1 Status: the advisory "Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret" named three flaws. The...
jfp-console-poc
JFP Console PoC Tamper-evident autonomous system governor w...
Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.
Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...
Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.
Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 patch 6 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...
GHSA-CP6G-7HQX-QXHP vulnerabilities
Vulnerabilities for packages: juicefs, grafana-mimir, external-secrets-operator, cortex, grafana, trufflehog, grafana-agent-operator, migrate, teleport, amazon-cloudwatch-agent, opentelemetry-collector-contrib, ksops, dapr, grafana-pyroscope, kubescape-operator, consul-k8s, argo-cd, promxy, ciliu...
CVE-2026-2303 vulnerabilities
Vulnerabilities for packages: juicefs, grafana-mimir, external-secrets-operator, cortex, grafana, trufflehog, grafana-agent-operator, migrate, teleport, amazon-cloudwatch-agent, opentelemetry-collector-contrib, ksops, dapr, grafana-pyroscope, kubescape-operator, consul-k8s, argo-cd, promxy, ciliu...
Malicious code in assert-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e21fa9c37e9944a00f7e85c7476f8fd4dc6bcd1f8fcd064a90488ef93d5bd12 [email protected] impersonates the chai assertion library bundles chai's source, contributors, and API surface under a different author and homepage...
MAL-2026-6200 Malicious code in assert-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e21fa9c37e9944a00f7e85c7476f8fd4dc6bcd1f8fcd064a90488ef93d5bd12 [email protected] impersonates the chai assertion library bundles chai's source, contributors, and API surface under a different author and homepage...
Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-27142 DESCRIPTION: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an...
Malicious code in portloop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c On default invocation e.g., npx portloop with no flags, the CLI runs in daemon+quiet+respawn mode and POSTs id, hostname, host, url, port, user to a...
MAL-2026-6194 Malicious code in portloop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c On default invocation e.g., npx portloop with no flags, the CLI runs in daemon+quiet+respawn mode and POSTs id, hostname, host, url, port, user to a...
CVE-2026-55226
When deploying only the Topic Operator or only the User Operator via the Kafka custom resource, the Entity Operator's ServiceAccount retains RBAC rights for both operators rather than scoping permissions to the one actually deployed. This allows the ServiceAccount to access KafkaUser custom...
CVE-2026-2303 vulnerabilities
Vulnerabilities for packages: prometheus, loki-fips, teleport-operator-fips, trident, loki, teleport, consul-k8s, cilium, ferretdb, virt-operator, kubescape, grafana-agent-operator, agentbeat-fips, trufflehog-fips, ory-kratos, beats, tetragon-fips, ratify-fips, weaviate, tekton-chains, tetragon,...
GHSA-CP6G-7HQX-QXHP vulnerabilities
Vulnerabilities for packages: prometheus, loki-fips, teleport-operator-fips, trident, loki, teleport, consul-k8s, cilium, ferretdb, virt-operator, kubescape, grafana-agent-operator, agentbeat-fips, trufflehog-fips, ory-kratos, beats, tetragon-fips, ratify-fips, weaviate, tekton-chains, tetragon,...
SUSE CVE-2026-50134
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...
EUVD-2026-37963
SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...
CVE-2026-12044
SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS '' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...
PT-2026-53792
Summary network-ai's ApprovalInbox lib/approval-inbox.ts is a shipped, exported, documented feature — "a web-accessible approval queue with REST API … and SSE streaming" SECURITY.md. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit huma...