CVE-2026-19889

CVE-2026-19889 is a Server-Side Request Forgery (SSRF) vulnerability in the GitLab AI Gateway component, affecting versions 18.9.0 through 19.0.12 , 19.1 through 19.1.7 , and 19.2 through 19.2.2 . An authenticated user with Duo Agent Platform access could redirect model requests to an externally-...

EUVD-2026-67087

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an...

CVE-2026-19889 Server-Side Request Forgery (SSRF) in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in its model-artifact APIs. The root cause is that TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs bypass pathsec enforcement by performing raw file operations on caller-controlled paths, allowing attack...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal due to raw file I/O in the TransitionParser, AveragedPerceptron, and PerceptronTagger model-artifact APIs. An attacker can...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991

Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...

EUVD-2026-66866

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

EUVD-2026-66822

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

Linux Distros Unpatched Vulnerability : CVE-2026-81726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...

Operationalizing Regulations into Code: A Model to Enhance Governance and Compliance in LLM Selection for Software Engineering

Integrating Large Language Models LLMs into the Software Development Life Cycle SDLC can improve developer productivity, but it also introduces security, privacy, and compliance risks during model selection. Regulations and frameworks such as the EU AI Act, the NIST AI Risk Management Framework...

PT-2026-82426

Name of the Vulnerable Software and Affected Versions Joomla Event Manager versions prior to 5.0.1 Description An issue in the administrator source model allows the upload of dangerous file types, including PHP files, which can lead to privileged remote code execution. Recommendations Update Joom...

PT-2026-82510

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.9.0 through 19.0.12 GitLab AI Gateway versions 19.1 through 19.1.7 GitLab AI Gateway versions 19.2 through 19.2.2 Description An issue in the AI Gateway component allows an authenticated user with Duo Agent Platfo...

PT-2026-82621

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4 Description Path traversal occurs in model-artifact APIs when pathsec is enabled. The issue arises from the use of raw file operations on caller-controlled paths, which allows bypassing pathsec enforcement. This...

PT-2026-82663

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations...