CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651: Missing Authorization

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-9138: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when...

PT-2026-85552

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated attackers can inject task runs into arbitrary environments because the software fails to validate environment membership during run replay operations. This allows attackers to repla...

GHSA-WW6M-CW3F-Q94G NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...

CVE-2026-77124: Incomplete List of Disallowed Inputs

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

PT-2026-83868

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

CVE-2026-81722

nltk PorterStemmer in versions ≤ 3.10.2 is vulnerable to an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The root cause is that the _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for ea...

CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104821 advisory. FFmpeg's RASC video decoder decodedlta in libavcodec/rasc.c performs 32-bit reads and writes at the row cursor before the NEXTLINE row-boundary check and validates t...

SUSE CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-55533: Improper Authentication

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

...[ More ]

This Metasploit module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an...

EUVD-2026-64852

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-49360

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

EUVD-2026-64204

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...