1186 matches found
PT-2026-69956
Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists where the operator uses a cryptographically weak pseudo-random number generator PRNG—a mathematical algorithm used to generate sequences of numbers that...
PT-2026-69960
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the 'V1 API' path. This issue allows the API server t...
PT-2026-69959
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...
PT-2026-69957
Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists in the Data Science Pipelines Operator where a namespace editor can inject dangerous parameters into the MySQL Data Source Name DSN string via the...
CVE-2026-61808
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...
CVE-2026-61808
CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...
CVE-2026-12261
A flaw was found in the nltk.downloader component of NLTK. This vulnerability allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces and only validates package integrity after extraction. This design flaw enables one package to...
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the downloader process. An attacker can compromise data integrity by causing package archiv...
CVE-2026-53985
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can...
EUVD-2026-54095
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can...
GHSA-22JQ-VG5J-6VGG vulnerabilities
Vulnerabilities for packages: sqlpad, opensearch-dashboards, code-server, renovate, kubeflow-pipelines, npm, pulumi, prism, lerna, langfuse, saf...
CVE-2026-69192 vulnerabilities
Vulnerabilities for packages: sqlpad, opensearch-dashboards, code-server, renovate, kubeflow-pipelines, npm, pulumi, prism, lerna, langfuse, saf...
CVE-2026-54272 vulnerabilities
Vulnerabilities for packages: sqlpad, opensearch-dashboards, code-server, renovate, kubeflow-pipelines, npm, pulumi, prism, lerna, langfuse, saf...
CVE-2026-69198 vulnerabilities
Vulnerabilities for packages: sqlpad, opensearch-dashboards, code-server, renovate, kubeflow-pipelines, npm, pulumi, prism, lerna, langfuse, saf...
GHSA-4XRF-JV44-H6HH vulnerabilities
Vulnerabilities for packages: sqlpad, opensearch-dashboards, code-server, renovate, kubeflow-pipelines, npm, pulumi, prism, lerna, langfuse, saf...