CVE-2026-67869

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

PT-2026-68989

Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves // payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...

PT-2026-68141

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description The compile program function in webserver/openplc.py fails to validate the file path variable when parsing FILE:path content directives from uploaded Structured Text .st program files. This allows an...

CVE-2026-66298: Origin Validation Error

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

CVE-2026-71268: Improper Limitation of a Pathname to a Restricted Directory

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Malicious code in eacq-payform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

GHSA-8R8H-6VCC-XHRV Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...

akto v2.16.5

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

ai-dynamo (>=0.1.0, <=1.1.1) potentially affected by CVE-2026-47619 via ai-dynamo-runtime (>=0.1.0, <=1.1.1)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.1 Source cves: CVE-2026-47619 Source advisory: MEND:CVE-2026-47619...

ai-dynamo (>=0.1.0, <=1.1.1) potentially affected by CVE-2026-47618 via ai-dynamo-runtime (>=0.1.0, <=1.1.1)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.1 Source cves: CVE-2026-47618 Source advisory: MEND:CVE-2026-47618...

ai-dynamo (>=0.1.0, <=1.1.1) potentially affected by CVE-2026-47617 via ai-dynamo-runtime (>=0.1.0, <=1.1.1)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.1 Source cves: CVE-2026-47617 Source advisory: MEND:CVE-2026-47617...

ai-dynamo (>=0.1.0, <=1.1.1) potentially affected by CVE-2026-47615 via ai-dynamo-runtime (>=0.1.0, <=1.1.1)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.1 Source cves: CVE-2026-47615 Source advisory: MEND:CVE-2026-47615...

ai-dynamo (>=0.1.0, <=1.1.1) potentially affected by CVE-2026-47614 via ai-dynamo-runtime (>=0.1.0, <=1.1.1)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.1 Source cves: CVE-2026-47614 Source advisory: MEND:CVE-2026-47614...

EUVD-2026-52801

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

ai-dynamo (>=0.1.0, <=1.1.0) potentially affected by CVE-2026-24253 via ai-dynamo-runtime (>=0.1.0, <=1.1.0)

ai-dynamo-runtime PYPI version =0.1.0, =0.1.0, =1.1.0 Source cves: CVE-2026-24253 Source advisory: MEND:CVE-2026-24253...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0,...