CVE-2026-100860

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

Code injection

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service libvirtd crash by triggering a failed unlink after creating a volume on a rootsquash NFS pool...