GHSA-GH4J-GQV2-49F6 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, langfuse, prism, renovate, saf, kubeflow-pipelines...

CVE-2026-41650 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, langfuse, prism, renovate, saf, kubeflow-pipelines...

GHSA-GH4J-GQV2-49F6 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, prism, librechat, py3-captum, langfuse, kubeflow-pipelines, tileserver-gl, opensearch-dashboards-fips, thingsboard-fips, tileserver-gl-fips, saf, renovate, opensearch-dashboards...

CVE-2026-41650 vulnerabilities

Vulnerabilities for packages: kibana, langfuse-fips, prism, librechat, py3-captum, langfuse, kubeflow-pipelines, tileserver-gl, opensearch-dashboards-fips, thingsboard-fips, tileserver-gl-fips, saf, renovate, opensearch-dashboards...

CLEANSTART-2026-CZ07385 Docker CLI for Windows searches for plugin binaries in C:\\\\\\\\ProgramData\\\\\\\\Docker\\\\\\\\cli-plugins, a directory that does not exist by default

Multiple security vulnerabilities affect the tekton-pipelines-fips package. Docker CLI for Windows searches for plugin binaries in C:\\\\ProgramData\\\\Docker\\\\cli-plugins, a directory that does not exist by default. See references for individual vulnerability details...

CLEANSTART-2026-FU04414 Docker CLI for Windows searches for plugin binaries in C:\\\\\\\\ProgramData\\\\\\\\Docker\\\\\\\\cli-plugins, a directory that does not exist by default

Multiple security vulnerabilities affect the tekton-pipelines-fips package. Docker CLI for Windows searches for plugin binaries in C:\\\\ProgramData\\\\Docker\\\\cli-plugins, a directory that does not exist by default. See references for individual vulnerability details...

CLEANSTART-2026-YD35232 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Multiple security vulnerabilities affect the tekton-pipelines-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See...

CLEANSTART-2026-FK30234 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Multiple security vulnerabilities affect the tekton-pipelines-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See...

XekRung Technical Report

We present XekRung, a frontier large language model for cybersecurity, designed to provide comprehensive security capabilities. To achieve this, we develop diverse data synthesis pipelines tailored to the cybersecurity domain, enabling the scalable construction of high-quality training data and...

CVE-2026-7466

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

EUVD-2026-26279

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipelinepath parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

Malicious code in @cap-js/postgres (npm)

Supply chain compromise of legitimate SAP packages published by threat actor "[email protected]" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs 4.4 KB and execution.js 11.1 MB bundled in the tarball, with a preinstall hook of "node...

CVE-2026-40924

A flaw was found in Tekton Pipelines. A local user with specific permissions to create TaskRuns or PipelineRuns can exploit this by directing the HTTP resolver to an attacker-controlled server. This server can return a very large response body, leading to the tekton-pipelines-resolvers pod...

PT-2026-35976

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

CVE-2026-40923

A flaw was found in Tekton Pipelines. An attacker can bypass restrictions on where volumes can be mounted by using specially crafted paths that include directory traversal sequences e.g., ... This vulnerability, stemming from an incomplete path validation check, could allow unauthorized access to...

CVE-2026-40886 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows...

GHSA-5JV8-H7QH-RF5P vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, kubeflow-pipelines, argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows...

CVE-2026-40886 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-5JV8-H7QH-RF5P vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Summary Gemini CLI @google/gemini-cli and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive headless environment...