CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102063 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdifpassthruplaybackgetresources uses...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102053)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102053 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidateremove function has incomplete logic f...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099763)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099763 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100542)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100542 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100109)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100109 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix dirty mapping checking in passthrough mode switching As mentioned in commit...

CVE-2026-72310

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

CVE-2026-72310: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

PT-2026-72498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the SMB client during the validation of the PASSTHRU FSCTL response payload within the smb2 ioctl query info function. The issue occurs because the...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

PT-2026-69968

Name of the Vulnerable Software and Affected Versions RHOAI training-operator affected versions not specified Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service...

SUSE CVE-2026-50545

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous...

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

ImpactLiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

GHSA-7488-6R32-C95Q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

EUVD-2026-42359

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback...

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...