PYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

SummaryIn affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

irisml-tasks-fiftyone (0.0.0) potentially affected by CVE-2026-53656 via fiftyone (0.16.6)

fiftyone PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - irisml-tasks-fiftyone 0.0.0 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

fiftyone-vertex-exporter (>=0.1.0, <=0.1.1), irisml-tasks-fiftyone (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-53656 via fiftyone (0.25.2)

fiftyone PYPI version 0.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on fiftyone and may be impacted: - fiftyone-vertex-exporter =0.1.0, =0.0.1, =0.0.4 Source cves: CVE-2026-53656 Source advisory: OSV:PYSEC-2026-3465...

New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs

Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs...

PT-2026-64091

Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enable tasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

CVE-2026-47688

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

EUVD-2026-46415

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

CVE-2026-47688

FOGProject vulnerability CVE-2026-47688 affects the FOGPage in FOG software. Before versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods can be invoked unauthenticated via a single HTTP GET to the public client node endpoint, enabling remote wiping of host AES encryptio...

CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

colony-cli (>=1.2.13b0, <=1.3.0b0), cumulusci (>=3.32.0, <=3.32.1) +16 more potentially affected by CVE-2026-59890 via setuptools (54.2.0)

setuptools PYPI version 54.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - colony-cli =1.2.13b0, =3.32.0, =0.1.0, =0.1.0, =0.0.1, =2.0.0.dev4, =0.0.1, =0.0.3, =1.4.0b0, =1.1.3, =0.5.0, =0.5.1 and more Source cves:...

proofground-push-tasks (1.0.0), pymor (>=2020.1.2, <=2021.1.0) +1 more potentially affected by CVE-2026-59890 via setuptools (49.1.3)

setuptools PYPI version 49.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - proofground-push-tasks 1.0.0 - pymor =2020.1.2, =0.2.0, =2021.3.1 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

CVE-2026-57494

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-57494

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

[SECURITY] Fedora 43 Update: ruby-3.4.10-31.fc43

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

EUVD-2026-45294

IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple...

CVE-2026-16015 poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function createtask of the file executormanager/app/api/v1/tasks.py of the component executormanager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...