CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

aind-airflow-jobs (>=0.2.1, <=0.2.6), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +2 more potentially affected by CVE-2026-75158 via apache-airflow (2.8.1)

apache-airflow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aind-airflow-jobs =0.2.1, =1.0.0b2, =1.1.1.post0.dev6, =1.1.3.post0.dev5 Source cves: CVE-2026-75158 Source advisory:...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-75158 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-75158 Source advisory:...

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Cybersecurity researchers have disclosed details of a new campaign dubbed TASKSTOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real...

RUSTSEC-2026-0304 Finished streaming calls keep reading a stalled request body indefinitely

Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...

CVE-2026-94145

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94625: Missing Release of Resource after Effective Lifetime

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

CVE-2026-63342: Incorrect Authorization

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

PT-2026-96315

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description A resource exhaustion issue exists in the MooncakeConnector component. Rejected prefill requests generate ownerless transfer placeholders that are not reclaimed by the system. An attacker can exploit...

PT-2026-96143

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description An issue exists in the platform used for orchestrating background tasks, AI agents, and durable workflows. The endpoint 'GET /api/v1/stable/durable-tasks/durable-task', implemented by the...

PT-2026-96273

Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver affected versions not specified Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task function. For control frames, the driver uses the 16-bit TLV field...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-88856: Improper Control of Generation of Code

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

PT-2026-95996

Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla Gallery versions prior to 6.2.7 Description An authenticated and privileged remote code execution issue exists in the OrdaSoft Joomla Gallery extension. The updateOSGallery function, accessible via the task=update osgallery...

PT-2026-95933

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description Remote command injection is possible within the TASK RUN COMMAND component. The issue exists in the paramiko.SSHClient.exec command function located in the backend/ops/host tasks.py file,...

PT-2026-95934

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description A command injection issue exists within the Command Handler component. The generate host task function in the backend/aiops/services.py file fails to properly handle the command argument,...

secator v0.44.0

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

SUSE CVE-2026-90305

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

SUSE CVE-2026-92486

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...