EUVD-2026-98170

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941: Improper Control of Generation of Code

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941

The Linketic CityGaussian software (versions up to 2.0 ) contains a code injection vulnerability within the Sidecar Parsing component. Specifically, the parse_cfg_args function in the internal/utils/common.py file is susceptible to exploitation because the manipulation of the cfg_args argument al...

CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559

EdgeEver Desktop versions 1.6.26 through 1.112.0 are vulnerable to a navigation allowlist bypass caused by insufficient string-prefix URL matching . Attackers can exploit this by embedding a link using userinfo syntax after the dev-server prefix—for instance, within a note-template preview—to loa...

EUVD-2026-97882

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559: Incorrect Authorization

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, kubeflow-pipelines, open-webui, datadog-agent, kubeflow-pipelines-visualization-server, az, kserve, kubeflow-jupyter-web-app, k8s-sidecar, kubeflow-katib, ggshield, kubeflow-volumes-web-app, jupyter-base-notebook...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: dask-kubernetes, kubeflow-pipelines, open-webui, datadog-agent, kubeflow-pipelines-visualization-server, az, kserve, kubeflow-jupyter-web-app, k8s-sidecar, kubeflow-katib, ggshield, kubeflow-volumes-web-app, jupyter-base-notebook...

CLEANSTART-2026-PH11243 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Security vulnerability affects the k8s-sidecar package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels...

CLEANSTART-2026-XW51025 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-MV63007 Security fix for GHSA-6v7p-g79w-8964 applied in: k8s-sidecar 2.10.3-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-108577

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

PT-2026-108498

Security vulnerability affects the k8s-sidecar package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels...

CLEANSTART-2026-ZF37263 Security fix for CVE-2024-35195 applied in: k8s-sidecar 1.25.2-r0, py3-requests 2.32.3-r0, py3.14-requests 2.32.3-r0

CVE-2024-35195 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GK32867 Security fix for CVE-2026-1703 applied in: k8s-sidecar 1.25.2-r0, kubernetes-csi-driver-nfs-fips 4.13.0-r0, python3 3.11.14-r0, python3 3.12.12-r0

CVE-2026-1703 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RV30467 Security fix for CVE-2026-44431 applied in: airflow-2 2.11.2-r1, airflow-3 3.1.8-r3, airflow-3 3.2.0-r0, apache-superset 5.0.0-r7, az 2.83.0-r1, az 2.84.0-r2, cassandra-reaper-fips 3.6.1-r4, cassandra-reaper-fips 3.8.0-r7, cassandra-reaper-fips 4.0.1-r4, jupyterhub-k8s-hub 4.3.2-r3, jupyterhub-k8s-hub 4.3.3-r0, k8s-sidecar 1.25.2-r1, k8s-sidecar 2.2.3-r0, k8s-sidecar 2.3.0-r0, k8s-sidecar 2.4.0-r0, k8s-sidecar 2.5.4-1, k8s-sidecar 2.5.5-r0, k8s-sidecar 2.6.0-r0, k8s-sidecar 2.7.1-r0, kserve-storage-controller 0.19.0-r0, miniforge3 25.11.0.1-r1, miniforge3 26.1.0.0-r1, miniforge3 26.1.1.0-r0, py3-jupyterhub 5.4.4-r0, tensorflow-gpu-jupyter 2.21.0-r5

CVE-2026-44431 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...