EUVD-2026-50470

Flyto2 Core: Unauthenticated flyto-verification /run: callbackurl SSRF and internal runner-secret exfiltration...

CVE-2026-67426

Flyto2 Core contains an unauthenticated SSRF risk in the standalone flyto-verification service (src/core/verification_service.py) prior to version 2.26.7. The service exposed POST /run on 0.0.0.0:8344 and used a client-supplied callback_url for outbound POSTs with X-Internal-Key: $FLYTO_RUNNER_SE...

PT-2026-65893

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description The standalone flyto-verification service in src/core/verification service.py exposes an unauthenticated POST '/run' endpoint on 0.0.0.0:8344. The service uses a client-supplied callback url for...

CVE-2026-67426: Missing Authentication for Critical Function

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...

SUSE CVE-2022-48764

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Free kvmcpuidentry2 array on post-KVMRUN KVMSETCPUID,2 Free the "struct kvmcpuidentry2" array on successful post-KVMRUN KVMSETCPUID,2 to fix a memory leak, the callers of kvmsetcpuid free the array only on failure. BUG:...

DEBIAN-CVE-2022-48764

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Free kvmcpuidentry2 array on post-KVMRUN KVMSETCPUID,2 Free the "struct kvmcpuidentry2" array on successful post-KVMRUN KVMSETCPUID,2 to fix a memory leak, the callers of kvmsetcpuid free the array only on failure. BUG:...