CVE-2026-63942

In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not...

CVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-53391 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

CVE-2026-51082

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...

EUVD-2025-210475

stoatchat delta versions before 20250210-1 0.8.2 contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft...

CVE-2025-71377 stoatchat before 20250210-1 Unrestricted Message History Fetch

stoatchat delta versions before 20250210-1 0.8.2 contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft...

CVE-2026-14890: Deserialization of Untrusted Data

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...

SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem

Overview A Pickle deserialization vulnerability has been discovered within the SGLang project, enabling an attacker to perform remote code execution RCE on the target vulnerable server. In order for an attacker to exploit this vulnerability, the expert-parallel backup subsystem must be enabled, a...

SQL injection vulnerability in pgAdmin 4 Maintenance Tool

SQL injection vulnerability in pgAdmin 4 Maintenance Tool.Four user-supplied JSON fields bufferusagelimit, vacuumparallel, vacuumindexcleanup, reindextablespace were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the...

parallel-ssh (1.1.1) potentially affected by CVE-2026-44405 via paramiko (2.1.6)

paramiko PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - parallel-ssh 1.1.1 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-2858...

TensorFlow has null dereference on ParallelConcat with XLA

ImpactWhen running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.pythonimport tensorflow as tffunc = tf.rawops.ParallelConcatpara = 'shape': 0, 'values': [email protected]=Truedef test: y = funcpa...

TensorFlow has null dereference on ParallelConcat with XLA

ImpactWhen running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.pythonimport tensorflow as tffunc = tf.rawops.ParallelConcatpara = 'shape': 0, 'values': [email protected]=Truedef test: y = funcpa...

PYSEC-2026-961 TensorFlow has null dereference on ParallelConcat with XLA

Impact When running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. python import tensorflow as tf func = tf.rawops.ParallelConcat para = 'shape': 0, 'values': 1 @tf.functionjitcompile=True def test: y =...

Maestro 0.17.3

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

Maestro 0.17.2

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

RockyLinux 8 : freerdp (RLSA-2023:2851)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2851 advisory. freerdp: clients using /parallel command line switch might read uninitialized data CVE-2022-39282 freerdp: clients using the /video command line switch...

org.jenkins-ci.plugins:cas-plugin (1.7.0), org.jenkins-ci.plugins:parallel-test-executor (500.va_5e1c1f1a_211) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1358.vb_26663c13537)

org.jenkins-ci.plugins:script-security MAVEN version 1358.vb26663c13537 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:cas-plugin 1.7.0 -...

org.jenkins-ci.plugins:cas-plugin (1.7.0), org.jenkins-ci.plugins:parallel-test-executor (500.va_5e1c1f1a_211) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1358.vb_26663c13537)

org.jenkins-ci.plugins:script-security MAVEN version 1358.vb26663c13537 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:cas-plugin 1.7.0 -...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3), org.jenkins-ci.plugins.workflow:workflow-cps (>=2.37, <=2.38) +3 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.30)

org.jenkins-ci.plugins:script-security MAVEN version 1.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =2.37, =1.22-beta-1, =1.10, =1.5, =1.6 Source...