48174 matches found
ACIArena: Toward Unified Evaluation for Agent Cascading Injection
Collaboration and information sharing empower Multi-Agent Systems MAS but also introduce a critical security risk known as Agent Cascading Injection ACI. In such attacks, a compromised agent exploits inter-agent trust to propagate malicious instructions, causing cascading failures across the...
PT-2026-31566
Name of the Vulnerable Software and Affected Versions atototo api-lab-mcp versions up to 0.2.1 Description A weakness exists in the HTTP Interface component of atototo api-lab-mcp. Manipulation of the source/url argument within the analyze api spec/generate test scenarios/test http endpoint...
Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the lodash JavaScript library
Summary Due to use of the lodash JavaScript library, DevOps Test Performance and Rational Performance Tester contain a potential denial of service DoS vulnerability. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution...
jwt-exploit-toolkit
JWT Exploit Toolkit !Pythonhttps://img.shields.io/badge/Py...
SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:1195-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1195-1 advisory. This update for google-cloud-sap-agent fixes the following issue: Update to google-cloud-sap-agent 3.12 bsc1259816: - CVE-2026-33186:...
CVE-2026-35449
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP...
io.modelcontextprotocol.sdk:mcp (1.0.0-rc3), io.modelcontextprotocol.sdk:mcp-json-jackson2 (1.0.0-rc3) +2 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (1.0.0-rc3)
io.modelcontextprotocol.sdk:mcp-core MAVEN version 1.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - io.modelcontextprotocol.sdk:mcp 1.0.0-rc3 -...
io.modelcontextprotocol.sdk:mcp (1.0.0-rc3), io.modelcontextprotocol.sdk:mcp-json-jackson2 (1.0.0-rc3) +2 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (1.0.0-rc3)
io.modelcontextprotocol.sdk:mcp-core MAVEN version 1.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - io.modelcontextprotocol.sdk:mcp 1.0.0-rc3 -...
Security Bulletin: DevOps Test Performance contains a vulnerabilty related to use of the qs library
Summary Due to the use of the qs library, DevOps Test Performance and Rational Performance Tester contain a potential denial-of-service vulnerability. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated values when...
Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the DOMPurify library
Summary Due to the use of the DOMPurify library, DevOps Test Performance and Rational Performance Tester contain a cross-site scripting XSS vulnerability CVE-2025-15599, CVE-2026-0540 Vulnerability Details CVEID:CVE-2025-15599 DESCRIPTION: DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8...
ml-management (>=0.1.0, <=0.4.0), telemed-sk (>=1.1.0, <=1.2.5) +1 more potentially affected by CVE-2026-33866 via mlflow (2.4.0)
mlflow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-management =0.1.0, =1.1.0, =1.0.0, =1.1.37 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...
ml-management (>=0.1.0, <=0.4.0), telemed-sk (>=1.1.0, <=1.2.5) +1 more potentially affected by CVE-2026-33865 via mlflow (2.4.0)
mlflow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-management =0.1.0, =1.1.0, =1.0.0, =1.1.37 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XVHR...
Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the @appium/support package
Summary Due to the use of the @appium/support package, DevOps Test Performance and Rational Performance Tester contain a potential path traversal vulnerability CVE-2026-30973, Vulnerability Details CVEID:CVE-2026-30973 DESCRIPTION: Appium is an automation framework that provides WebDriver-based...
ml-management (>=0.1.0, <=0.4.0), telemed-sk (>=1.1.0, <=1.2.5) +1 more potentially affected by CVE-2026-33865 +1 more via mlflow (2.4.0)
mlflow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-management =0.1.0, =1.1.0, =1.0.0, =1.1.37 Source cves: CVE-2026-33865, CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...
ml-management (>=0.1.0, <=0.4.0), telemed-sk (>=1.1.0, <=1.2.5) +1 more potentially affected by CVE-2026-33865 via mlflow (2.4.0)
mlflow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-management =0.1.0, =1.1.0, =1.0.0, =1.1.37 Source cves: CVE-2026-33865 Source advisory: OSV:PYSEC-2026-93...
Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issue: Update to google-cloud-sap-agent 3.12 bsc1259816: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260265. Changelog: Collect WLM metric...
BIT-DISCOURSE-2026-33185 Discourse: Group SMTP test endpoint susceptible to SSRF
Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.3, and 2026.2.0 to before 2026.2.2, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal...
Oracle Linux 10 : freerdp (ELSA-2026-6799)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-6799 advisory. 2:3.10.3-5.5 - Fix use of nscprocessmessage - Increase timeout for TestSynchCritical Resolves: RHEL-155979 2:3.10.3-5.4 - Backport several CVE fixes...
freerdp security update
2:3.10.3-5.5 - Fix use of nscprocessmessage - Increase timeout for TestSynchCritical Resolves: RHEL-155979 2:3.10.3-5.4 - Backport several CVE fixes Resolves: RHEL-147948, RHEL-147949, RHEL-147956, RHEL-147963, RHEL-147964 Resolves: RHEL-147972, RHEL-147979, RHEL-147984, RHEL-147985, RHEL-148898...
CVE-2026-35449
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP...