CVE-2026-12479

A flaw was found in Keras, specifically in the model saving and loading library. This path traversal vulnerability occurs due to improper handling of user-provided layer names, which allows an attacker to craft a malicious Keras model. When this model is saved or loaded, it can escape its intende...

CVE-2026-48588

creationtimestamp| type| source ---|---|--- 2026-07-07 15:02:03+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq2uqb2zhm2c 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:28:41+00:00| seen|...

PYSEC-2026-1431 Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference

RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the GET /api/v2/dagSources/dagid endpoint, which returns the entire source file containing multiple DAGs without redacting those the user is not authorized to access. An attacker can...

RLSA-2026:35826 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via...

CVE-2026-54059

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

CVE-2026-48892

creationtimestamp| type| source ---|---|--- 2026-07-07 11:44:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jnxkscc2t 2026-07-07 12:06:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2kw5rdo32e...

CVE-2026-33264

creationtimestamp| type| source ---|---|--- 2026-07-07 10:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116878227880912732 2026-07-07 10:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23 2026-07-07 11:38:55+00:00| seen|...

CVE-2026-49296

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

EUVD-2026-42027

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

CVE-2026-49296 Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

CVE-2026-49296

CVE-2026-49296 (Apache Airflow) : Affected versions before 3.3.0 expose the full source of co-located DAGs when reading a single DAG via GET /api/v2/dagSources/{dag_id} or the UI view, bypassing per-DAG read controls. This can disclose multiple DAG sources from the same file to authorized readers...

CVE-2026-49296 Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

CVE-2026-55379

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical...

CVE-2026-4375

creationtimestamp| type| source ---|---|--- 2026-07-07 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116877520158002101 2026-07-07 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq23iqtn2r2u 2026-07-07 14:12:06+00:00| seen|...

CVE-2026-34037

creationtimestamp| type| source ---|---|--- 2026-07-07 04:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpzpxpr5wr2h 2026-07-07 04:21:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzqxmsj2d2u 2026-07-07 04:30:26+00:00| seen|...

CVE-2026-14604

A flaw was found in Open Asset Import Library Assimp. This vulnerability, a double free, exists within the PLY Model Handler component. A remote attacker could exploit this flaw by manipulating PLY model files, leading to a denial of service and making the application unavailable. Mitigation To...

PT-2026-56272

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650 Description Code injection is possible via a caller-influenced Profile attribute. When a string is assigned to this attribute, the software splits it into path, package, and arguments, then interpolates the package...

PT-2026-56179

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.3.0 Description An authorization bypass occurs when a user with permission to read a specific Dag can disclose the source code of other Dags located within the same source file. This issue affects deployments...

Data Import for Veeam Data Cloud for Salesforce

Purpose This article explains the Data Import feature in Veeam Data Cloud for Salesforce VDCSF: what it does, which sources it currently supports, and how to prepare data for importation. This article is a feature summary only. Full procedural documentation can be found in the VDCSF User Guide...