PT-2026-37534

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel networking stack where the system incorrectly handles transmission xmit return codes for Generic Segmentation Offload GSO frames in environments witho...

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file...

PT-2026-37422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the cifs sanitize prepath function. This occurs when the function is called with an empty string or a string consisting solely of delimiters, such as "/"...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2026-35397 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-35397 Source advisory: OSV:PYSEC-2026-68...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2026-40934 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-40934 Source advisory: OSV:GHSA-5MRQ-X3X5-8V8F...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2026-40110 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-40110 Source advisory: OSV:GHSA-24QX-W28J-9M6P...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2026-35397 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-35397 Source advisory: OSV:GHSA-5789-5FC7-67V3...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2025-61669 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2025-61669 Source advisory: OSV:GHSA-QH7Q-6QM3-653W...

scikit-rt (>=0.3.20, <=0.8.2), spatial-networks (>=0.0.4, <=0.0.7) +2 more potentially affected by CVE-2025-61669 via jupyter-server (1.18.1)

jupyter-server PYPI version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - scikit-rt =0.3.20, =0.0.4, =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2025-61669 Source advisory: OSV:PYSEC-2026-67...

CLSA-2026-1777944610 grafana: Fix of CVE-2026-27877

CVE-2026-27877: fix exposure of direct data-source passwords via public dashboards by limiting frontend settings to data sources actually used by the dashboard - Note: upstream test additions in pkg/api/frontendsettingstest.go are not backported. The %check stage only runs the Jest frontend suite...

Generating Proof-Of-Vulnerability Tests to Help Enhance the Security of Complex Software

Developers create modern software applications Apps on top of third-party libraries Libs. When library vulnerabilities are reachable through application code, the applications can be vulnerable to software supply chain attacks. Prior work shows that developers often require concrete and executabl...

CVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

io.quarkiverse.artemis:quarkus-integration-test-artemis-core (1.0.2), io.quarkiverse.artemis:quarkus-integration-test-artemis-jms (1.0.2) +105 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.6.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.artemis:quarkus-integration-test-artemis-core 1.0.2 -...

CVE-2026-7730

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

CVE-2026-7730

CVE-2026-7730 affects privsim mcp-test-runner 0.2.0. The vulnerability is in the MCP Interface’s src/index.ts where the function child_process.spawn mishandles the argument command, enabling an os command injection. Impact may be remote; exploit publicly available. Documents do not provide remedi...

CVE-2026-7730 privsim mcp-test-runner MCP index.ts child_process.spawn os command injection

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

EUVD-2026-26884

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

CVE-2026-7730 privsim mcp-test-runner MCP index.ts child_process.spawn os command injection

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

Test Runner MCP 命令注入漏洞

Test Runner MCP is a multi-framework testing and result-analysis tool for PrivSim individual developers. Version 0.2.0 of Test Runner MCP contains a command injection vulnerability. This vulnerability stems from the use of the childprocess.spawn function in the MCP Interface component, which allo...

Nginx UI 代码注入漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI prior to 2.3.8 had a code injection vulnerability. This vulnerability stemmed from the backup restoration endpoint POST /api/restore, which operates without authentication within the first 10 minutes after the process...