CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Component: tract-nnef nnef/src/tensors.rs::readtensor + tract-data data/src/tensor.rs - Affected versions: 0.21.16, 0.22.0–0.22.2, 0.23.0–0.23.1 — the dense DatLoader path was unguarded across all three release lines; patched in 0.21.16 / 0.22.2 / 0.23.1 - Class: CWE-190 integer overflow →...

GHSA-X5MV-8WGW-29HG tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Component: tract-nnef nnef/src/tensors.rs::readtensor + tract-data data/src/tensor.rs - Affected versions: 0.21.16, 0.22.0–0.22.2, 0.23.0–0.23.1 — the dense DatLoader path was unguarded across all three release lines; patched in 0.21.16 / 0.22.2 / 0.23.1 - Class: CWE-190 integer overflow →...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2026-44727 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-44727 Source advisory: OSV:GHSA-FCW5-X6J4-CCMP...

mplfooty (>=0.0.1, <=0.2.0), total-points-model (>=1.0.3, <=1.0.5) potentially affected by CVE-2026-44727 via jupyter-server (1.23.4)

jupyter-server PYPI version 1.23.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - mplfooty =0.0.1, =1.0.3, =1.0.5 Source cves: CVE-2026-44727 Source advisory: OSV:GHSA-FCW5-X6J4-CCMP...

MINI-P432-42J3-FVPP

Bulletin has no description...

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...

GHSA-C969-5X3P-VQ3V PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/emailtools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters fromaddr, subject, query directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who...

CVE-2026-42487

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

ALPINE-CVE-2026-42487

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

CVE-2026-42487

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

CVE-2026-42487 x86 HVM I/O port list traversal

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

EUVD-2026-37888

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

CVE-2026-42487

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load

tractnnef::tensors::readtensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes both the element count productshape and the byte allocation productshape sizeofdt with unchecked usize arithmetic. In release builds no overflow-checks both products wrap modulo 2^64. A...

MINI-777W-PHRM-H39P

Bulletin has no description...

MINI-498V-4572-P6XH

Bulletin has no description...

Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model

Analysis tools do not need AI built in to support agentic workflows; they simply need to expose their data through an external scripting interface. Even traditional graphical user interface GUI applications can be made AI-accessible by publishing their internal object models, allowing agents to...