Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

CVE-2026-66317 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66317

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-66317

Technical details (affected product/components, root cause, impact, or remediation) are not publicly available in the provided documents. Monitor for updates from MSRC/NVD/ENISA EUVD for new information.

CVE-2026-66317 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66311

CVE-2026-66311: Microsoft Edge (Chromium-based) Tampering Vulnerability. Local attacker can tamper due to missing authorization. Affects Edge when running Chromium-based builds; CVSSv3.1 base score 6.2 (Medium), confidentiality impact High, no impact to integrity/availability. Remediation: apply ...

CVE-2026-66311 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66311

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66311 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66313 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66313

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66313

CVE-2026-66313: A origin validation error in Microsoft Edge (Chromium-based) enables local tampering by an unauthorized attacker. Documents confirm the vulnerability exists but provide no specific exploit details or mitigations; no patch/version is stated in the supplied sources. Remediation stat...

CVE-2026-66313 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

GHSA-V8FG-2RW7-Q452 Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth

A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in it...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

UBUNTU-CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

EUVD-2026-52226

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

The CVE affects nltk 3.9.4: nltk.downloader.Downloader._download_package() can write package bytes to disk and may extract them before SHA-256/MD5 checks, enabling tampering via compromised mirrors or proxies. This could lead to installation of attacker-controlled package bytes (potentially malic...