LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

GHSA-V4P8-MG3P-G94G LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

CVE-2026-31676

The CVE-2026-31676 issue concerns the Linux kernel’s rxrpc subsystem. A flaw allowed duplicate or late RESPONSE packets to be processed outside the intended RXRPC_CONN_SERVICE_CHALLENGING state. The fix enforces state-checking under a state_lock before performing response verification and securit...

[SECURITY] Fedora 44 Update: python3.13-3.13.13-1.fc44

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.13 package provides the "python3.13" executable:...

[SECURITY] Fedora 44 Update: python3.9-3.9.25-7.fc44

Python 3.9 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.9 package provides the "python3.9" executable: the...

OSV-2026-623 Use-of-uninitialized-value in Mat_PrintNumber

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903317 Crash type: Use-of-uninitialized-value Crash state: MatPrintNumber MatPrintData MatVarPrint...

PT-2026-37185

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.74.2 through 1.83.6 Description LiteLLM, a proxy server for Large Language Model APIs, contains a flaw where two endpoints used to preview an MCP server before saving it accept a full server configuration in the request body...

GHSA-XQMJ-J6MV-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Impact The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user cou...

Improper Neutralization of Special Elements Used in a Template Engine

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the POST /prompts/test endpoint, which accepts user-supplied prompt templates and renders them...

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Impact The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user cou...

AZL-84032 CVE-2026-31585 affecting package kernel for versions less than 6.6.137.1-1

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix nfeeds state corruption on startstreaming failure syzbot reported a memory leak in vidtvpsiservicedescinit 1. When vidtvstartstreaming fails inside vidtvstartfeed, the nfeeds counter is left incremented even...

EUVD-2026-25541

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nrpages calculation overflow in filemapmappages When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state": " 734.496287 BUG: Bad...

CVE-2026-31648 mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nrpages calculation overflow in filemapmappages When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state": " 734.496287 BUG: Bad...

Exploit for CVE-2026-41679

CVE-2026-41679 Introduction This POC tests if a paperclip...

PT-2026-103642

Уязвимость системы управления тестированием ПО Test IT связана с использованием учетных данных по умолчанию. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

golang security update

1.25.9-3 - Do not ignore any tests in check 1.25.9-2 - Skip terminal test in container 1.25.9-1 - Update to Go 1.25.9 fips-2...

buildah security update

1.41.8-3.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.41.8-3 - rebuild for CVE-2026-34986 - Resolves: RHEL-165027...

PT-2026-103644

Уязвимость системы управления тестированием ПО Test IT связана с применением входных данных с внешним управлением для выбора классов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольные команды...

PT-2026-103643

Уязвимость системы управления тестированием ПО Test IT связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить SSRF-атаку...

PT-2026-37176

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.80.5 through 1.83.6 Description The 'POST /prompts/test' endpoint accepts user-supplied prompt templates and renders them without sandboxing. An authenticated user with a valid proxy API key can provide a crafted template to...