PT-2026-72088

Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...

RHEL 8 : Red Hat OpenStack Platform 16.2 security advisory (Important) (RHSA-2026:54757)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54757 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

CVE-2026-73304

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

CVE-2026-73302 Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

EUVD-2026-58543

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-73505

Oh My Posh is affected by CVE-2026-73505 due to setStyle() rendering the path via Go templates, exposing a cmd function in the template map. An attacker-controlled directory name containing a Go template expression could execute arbitrary OS commands as the current user when the prompt renders in...

.NET: .NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-0291

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-0293

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is...

EUVD-2026-57707

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is...

PT-2026-71374

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-50544: Creation of Temporary File in Directory with Insecure Permissions

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

CVE-2026-73307

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:17+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hfhx-w8p8-4hc7...

iris-web v2.4.29

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

EUVD-2026-57509

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

CVE-2026-73407

Budibase CVE-2026-73407: Unauthenticated REST datasource credential theft via cross-origin auth leak in RestIntegration._req (packages/server/src/integrations/rest.ts) prior to 3.40.1. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId could supply an absolute or parameterized pa...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-68971 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-68971 Source advisory: OSV:GHSA-5247-M8W9-2V4M...