CLEANSTART-2026-EH11286 Security fixes for CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw applied in versions: 0.12.0-r1, 0.12.0-r2

Multiple security vulnerabilities affect the kserve-modelmesh-serving package. These issues are resolved in later releases. See references for individual vulnerability details...

Cross-site Scripting (XSS)

EasyAdmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient restrictions on uploaded file types and serving uploaded files inline from the public web root, which allows an attacker to upload malicious HTML or SVG files that execute JavaScript in an administrator'...

vitest: Vitest: Arbitrary code execution and information disclosure via path traversal

A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading ...

CVE-2026-55466 Snipe-IT: Stored XSS via inline-served attachment

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline, allowing a low-privilege user to upload active...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: govulncheck, lvm-driver, nri-discovery-kubernetes, ctop, kpt, sftpgo-plugin-auth, nodetaint, docker, podinfo, pulumi, docker-credential-acr-env, mc, crossplane-provider-aws-sns, argocd-image-updater, fuse-overlayfs-snapshotter, openbao-k8s, sops, tempo,...

PYSEC-2026-1552 Litestar and Starlite vulnerable to Path Traversal

Summary Local File Inclusion via Path Traversal in LiteStar Static File Serving A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to...

CVE-2026-54234 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then convert...

PYSEC-2026-405 Ludwig framework is vulnerable to insecure deserialization in its model serving component

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load without enabling the security-restrictive weightsonly=True...

PYSEC-2026-423 MLflow Command Injection vulnerability

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the installmodeldependenciestoenv function. When deploying a model with envmanager=LOCAL, MLflow reads dependency specifications from the model artifact's pythonenv.yaml file and...

PYSEC-2026-424 Mlflow: Command Injection when serving models with enable_mlserver=True

A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: commercial-grafana, trivy-operator, zot, drone, external-secrets-operator-fips, omnictl-multiarch, opentofu-fips, gitlab-workhorse-ce-fips, kaf, prometheus-operator, snyk-cli, kuma, flux-source-controller, knative-eventing-fips, knative-kafka-broker, argo-cd-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-network, buildah-fips, gitlab-runner, commercial-grafana, trivy-operator, zot, drone, crossplane-provider-azure-powerbidedicated, external-secrets-operator-fips, neuvector-sigstore-interface, omnictl-multiarch, opentofu-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: commercial-grafana, trivy-operator, zot, drone, external-secrets-operator-fips, omnictl-multiarch, opentofu-fips, gitlab-workhorse-ce-fips, kaf, prometheus-operator, snyk-cli, kuma, flux-source-controller, knative-eventing-fips, knative-kafka-broker, argo-cd-fips,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: buildah-fips, commercial-grafana, zot, omnictl-multiarch, external-secrets-operator-fips, opentofu-fips, gitlab-workhorse-ce-fips, kaf, docker-cli-buildx, prometheus-operator, snyk-cli, kuma, knative-eventing-fips, knative-kafka-broker, argo-cd-fips, argo-cd,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: gitlab-runner, commercial-grafana, trivy-operator, zot, drone, external-secrets-operator-fips, omnictl-multiarch, opentofu-fips, gitlab-workhorse-ce-fips, kaf, pulumi-kubernetes-operator, chainctl-fips, docker-cli-buildx, prometheus-operator, snyk-cli, packer-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: zot, omnictl-multiarch, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-aws-datasync, crossplane-provider-azure-security, crossplane-provider-azure-servicebus, crossplane-provider-azure-streamanalytics,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-network, buildah-fips, gitlab-runner, commercial-grafana, trivy-operator, zot, drone, crossplane-provider-azure-powerbidedicated, external-secrets-operator-fips, neuvector-sigstore-interface, omnictl-multiarch, opentofu-fips,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: buildah-fips, commercial-grafana, zot, omnictl-multiarch, external-secrets-operator-fips, opentofu-fips, gitlab-workhorse-ce-fips, kaf, docker-cli-buildx, prometheus-operator, snyk-cli, packer-fips, kuma, knative-eventing-fips, knative-kafka-broker, argo-cd-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: gitlab-runner, commercial-grafana, trivy-operator, zot, drone, external-secrets-operator-fips, omnictl-multiarch, opentofu-fips, gitlab-workhorse-ce-fips, kaf, pulumi-kubernetes-operator, chainctl-fips, docker-cli-buildx, prometheus-operator, snyk-cli, packer-fips,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: buildah-fips, commercial-grafana, trivy-operator, zot, omnictl-multiarch, external-secrets-operator-fips, opentofu-fips, gitlab-workhorse-ce-fips, kaf, pulumi-kubernetes-operator, chainctl-fips, docker-cli-buildx, prometheus-operator, snyk-cli, packer-fips, kuma,...