27395 matches found
CVE-2026-48499
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...
CVE-2026-15971 CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
CVE-2026-15971
In CVE-2026-15971, SGLang contains a remote code execution vulnerability when the optional dumper subsystem is enabled. A sandbox escape occurs if DUMPER_SERVER_PORT is set, enabling code execution on inference requests.
EUVD-2026-51262
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests...
CVE-2026-48499 Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...
CVE-2026-48499
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...
CVE-2026-48499
Activepieces contains a cross-tenant data exposure and code injection vulnerability (CVE-2026-48499) due to an unsanitized path segment in the Code piece sandbox. Before version 0.84.0, an authenticated flow author could reach read-write cached flow and code files belonging to other tenants on th...
CVE-2026-13435 Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation...
CVE-2026-13435
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation...
CVE-2026-13435
The CVE-2026-13435 entry concerns IBM Langflow OSS versions 1.0.0–1.10.1, where an improper input validation in the PythonREPL sandbox allows code execution within a restricted globals environment. The root cause is a bypass of the sandbox validator, enabling access to sensitive values in the ser...
EUVD-2026-51244
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation...
EUVD-2026-50473
Flyto2 Core: Arbitrary file write via image.download and other file-writing modules...
Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz , which codenamed the chain CosmosEscape , said the exploit chain began with a...
RLSA-2026:47101 Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component...
NestJS DevTools Integration - Remote Code Execution
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...
ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...
Mesop AI Sandbox <= 1.2.2 - Remote Code Execution
Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...
CVE-2026-17778
A flaw was found in Google Chrome. This use-after-free vulnerability in the Extensions component allows a remote attacker to execute arbitrary code within a sandbox. This can be exploited by convincing a user to install a specially crafted Chrome Extension...
DEBIAN-CVE-2026-18015
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...