CVE-2026-45227 Heym < 0.0.21 Sandbox Escape via Python Introspection

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), com.github.waffle:waffle-tomcat7 (1.8.2) +11 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.73)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.73 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - ai.foremast.metrics:foremast-spring-4x-k8s-metrics =0.1.6, =2.1.0, =2.1.0, =2.1.0, =1.2.0,...

net.myrrix:myrrix-web (0.7), org.apache.geode:geode-modules-tomcat7 (>=1.0.0-incubating.m2, <=1.0.0-incubating.m3) +30 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (7.0.30)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.myrrix:myrrix-web 0.7 - org.apache.geode:geode-modules-tomcat7 =1.0.0-incubating.m2,...

net.myrrix:myrrix-web (0.7), org.apache.geode:geode-modules-tomcat7 (>=1.0.0-incubating.m2, <=1.0.0-incubating.m3) +30 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.30)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.myrrix:myrrix-web 0.7 - org.apache.geode:geode-modules-tomcat7 =1.0.0-incubating.m2,...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), com.github.waffle:waffle-tomcat7 (1.8.2) +11 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (7.0.73)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.73 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - ai.foremast.metrics:foremast-spring-4x-k8s-metrics =0.1.6, =2.1.0, =2.1.0, =2.1.0, =1.2.0,...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

PT-2026-40452

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.21 Description A sandbox escape exists in the custom Python tool executor. Authenticated workflow authors can bypass sandbox restrictions using object-graph introspection primitives. By employing Python introspection...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-2614 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-2614 Source advisory: OSV:GHSA-42H5-H8QH-VV9V...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

CVE-2026-32683

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app to the latest version and enable the video...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-2393 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-2393 Source advisory: OSV:GHSA-65H7-C7C4-MGHX...

pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

CVE-2026-42866

Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's writetxt, writecsv, writejson, and commented-but-shipping scanfile helpers open their output as openf"user.", where user comes unsanitized from the -u CLI flag or any line of a -U usernames file. A userna...

CVE-2026-44777

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-2393 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-2393 Source advisory: OSV:PYSEC-2026-2219...