CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use o...

CVE-2026-115812

Amazon Web Services Multi Model Server versions 1.1.11 and earlier are vulnerable to a relative path traversal flaw during model archive extraction. This vulnerability could allow remote actors to execute arbitrary code by providing a crafted model archive. Because Multi Model Server is end of li...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Spring

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Spring. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2016-5007 DESCRIPTION: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x,...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by a Jackson-databind access control bypass vulnerability

Summary SPSS Collaboration and Deployment Services is affected by a Jackson-databind access control bypass vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59889 DESCRIPTION: jackson-databind contains the general-purpose data-binding...

CVE-2026-55190

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...

CVE-2026-55190 Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...

EUVD-2026-108748

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...

CVE-2026-55190

The open-source platform Event Schedule versions 1.0.0 and prior is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists in the App luss iejsUrlUtils::isUrlSafe() function, which fails to properly validate user-supplied import URLs. Attackers can bypass the SSRF guard using brackete...

CVE-2026-55190 Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...

Agent-To-Agent Synthetic Social Engineering on the Web

An AI agent can prepare an accurate report and still request an action its user has not authorized. Cooperation across Web services therefore requires separate judgments about identity, evidentiary support, and permission. We define synthetic social engineering SSE as deliberately deceptive or...

PT-2026-122189

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users shoul...

ROS-20261023-73-0227

The vulnerability of the onresize function in the VIM text editor, related to handling size changes involving writing beyond the boundaries, allows a hacker to bypass application services...

ROS-20261023-73-0229

The vulnerability of the unserializeuep function in the VIM text editor arises when the size-checking mechanism for file records is disabled. This issue stems from incorrect calculations of buffer sizes, allowing attackers to bypass application services...

PT-2026-121942

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, AppUtilsUrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the...

dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper certificate validation in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-101795

A flaw was found in the Components Services component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-101788

A flaw was found in MySQL Server and MySQL Cluster within the Server Components Services. This vulnerability allows an unauthenticated remote attacker with network access via multiple protocols to cause a Denial of Service DoS. A successful attack can cause the database server to hang or repeated...

CVE-2026-101778

A flaw was found in the Components Services component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact...

CVE-2026-101721

A flaw was found in mysql. A remote attacker with high privileges and network access can exploit this vulnerability to cause a Denial of Service DoS. By targeting the server component services, the attacker can cause the database to hang or crash repeatedly, disrupting availability for legitimate...