Linux Distros Unpatched Vulnerability : CVE-2026-40080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather...

PT-2026-53890

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator !== to validate the webhook secret token. This implementation is vulnerable to timing attack...

Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming

The fast growth of open-source AI infrastructure, from model serving engines and agent platforms to the Model Context Protocol MCP ecosystem and the language models themselves, has outpaced the security tooling available to defend it. We present AI-Infra-Guard, an open-source framework that...

PT-2026-53999

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 5.13.27 Description An open redirect exists in the client portal login. Unauthenticated attackers can redirect authenticated users to external URLs by injecting a malicious value into the intended query paramete...

FreeBSD Security Advisory - FreeBSD-SA-26:44.posixshm

FreeBSD Security Advisory - Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. Separately, certain...

PT-2026-53958

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.6 Description A missing authentication flaw exists in the /api/v1/build public tmp/ endpoints. This allows an unauthenticated attacker to use a valid job identifier to read build event data or cancel...

PT-2026-53949

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Authenticated attackers can execute arbitrary OS commands and read sensitive files, including credentials. This can lead to complete system compromise and lateral movement within the...

IBM Business Automation Manager Open Editions input validation error vulnerability

Versions 9.0.0 through 9.4.2 of IBM Business Automation Manager Open Editions contain an input validation error vulnerability. This vulnerability arises from the susceptibility of XML data processing to XML External Entity XXE attacks, which may allow remote attackers to disclose sensitive...

FreeBSD -- Multiple vulnerabilities in POSIX largepage objects

Problem Description: Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. CVE-2026-49427 Separately,...

EUVD-2026-40236

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying...

Security Bulletin: Code Injection via Custom Component Endpoint with Authentication Bypass

Summary A code injection vulnerability was identified in the custom component endpoint that allowed execution of arbitrary Python code through the component creation process. The vulnerability was compounded by an authentication bypass feature where AUTOLOGIN was enabled by default, allowing...

Security Bulletin: Insecure Deserialization in Redis Cache Backend

Summary A deserialization vulnerability was identified in the Redis cache service that could allow attackers with network access to the Redis instance to execute arbitrary code. The cache service used dill.loads to deserialize cached values without integrity verification, enabling attackers to...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the privatekeyjwt authentication process. An attacker can generate access tokens as another client by exploiting the JWKS resolver cache, without possessing the victim's signing key, if the target client has...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filena...

exploitarium-fork

If you wish to collaborate/discuss with me, contact me on discor...

fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2026-49468 via litellm (0.8.6)

litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2026-49468 Source advisory: OSV:PYSEC-2026-388...

open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-49468 via litellm (0.13.2)

litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2026-49468 Source advisory: OSV:PYSEC-2026-388...

bavisitter (>=0.0.0, <=0.1.0rc1), cosmoai (>=0.8.8, <=0.9.1.11) +1 more potentially affected by CVE-2026-49468 via litellm (0.13.0)

litellm PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - bavisitter =0.0.0, =0.8.8, =0.9.1.11 - open-interpreter 0.1.11 Source cves: CVE-2026-49468 Source advisory: OSV:PYSEC-2026-388...

open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-49468 via litellm (0.7.10)

litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.31 Source cves: CVE-2026-49468 Source advisory: OSV:PYSEC-2026-388...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44551 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44551 Source advisory: OSV:PYSEC-2026-435...