EUVD-2026-104688

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...

CVE-2026-77932

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...

CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...

CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock getuserfromheaders function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandbox...

CLEANSTART-2026-ZB05903 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-WY78663 On Linux, if the target of Root

Security vulnerability affects the grafana-fips package. On Linux, if the target of Root...

WS-2026-0173

uv 0.0.5 through 0.13.3 trusts the "emSign ECC Root CA - G3" root through its vendored webpki-root-certs/webpki-roots bundle. Intermediates under this root were revoked for key compromise, so certificates issued with the compromised CA keys are accepted by uv for any hostname, enabling...

Red Hat: CVE-2026-113812: perl-mozilla-ca: Mozilla::CA: TLS server impersonation via compromised intermediate certificates

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able...

PT-2026-117950

Name of the Vulnerable Software and Affected Versions DB-GPT versions prior to 0.8.3 Description An unauthenticated remote code execution issue exists because the /api/v1/chat/react-agent endpoint uses a mock get user from headers function that assigns the admin role to all callers regardless of...

PT-2026-117951

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL ROOT PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database acce...

PT-2026-118286

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

ProSoft RLX-IFH24E version 2.2.44 Unsigned Upgrade Package Root Command Execution

ProSoft RLX-IFH24E version 2.2.44 firmware upgrades do not verify package authenticity, allowing an authenticated attacker to upload a crafted package that executes commands as root on the appliance. https://packetstorm.news/download/236509...

PT-2026-119044

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able...

PT-2026-118361

Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local security restrictions and gain root access on th...

PT-2026-118476

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.15 Description A symlink following issue exists in the Statistics::makeChownWithNewStats function. Authenticated customers can exploit this by replacing the goaccess statistics directory in their document root wit...

PT-2026-120312

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An...

PT-2026-120334

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

PT-2026-120335

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An...

PT-2026-120303

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

PT-2026-118590

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A versions prior to M30BE1 V251117 Description An OS command injection flaw exists in the sub 23B54 function of the ioos binary. The issue occurs when the /protocol.csp?opt=ovpn file endpoint processes requests with type=de...