CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, authentik, airflow-core, tritonserver-backend-vllm-cuda-13.0, metaflow-service-fips, apache-beam-python-3.12-sdk, mlflow, awx, lmcache-cuda-12.8, mlflow-fips,...

CVE-2026-54274 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, authentik, airflow-core, tritonserver-backend-vllm-cuda-13.0, metaflow-service-fips, apache-beam-python-3.12-sdk, mlflow, awx, lmcache-cuda-12.8, mlflow-fips,...

CVE-2026-54277 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries-aiohttp, apache-beam-python-3.13-sdk, tritonserver-backend-vllm-cuda-12.9, authentik, airflow-core, tritonserver-backend-vllm-cuda-13.0, metaflow-service-fips, apache-beam-python-3.12-sdk, mlflow, awx, lmcache-cuda-12.8, mlflow-fips,...

Grimoire

書 — The Pentesterʼs Spellbook Answer the questions. Unleash th...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via the font retrieving. An attacker can cause the application to enter an infinite loop by crafting a specially...

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

PT-2026-49960

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Metadata Plugin component of the Oracle Enterprise Manager Base Platform. A low privileged attacker wi...

PT-2026-49950

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Discovery Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

PT-2026-49965

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Oracle Management Service component of the Oracle Enterprise Manager Base Platform. This flaw allows a...

PT-2026-49962

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Target Management component of the Oracle Enterprise Manager Base Platform. A low privileged attacker...

PT-2026-49980

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Install. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-36809

Subscriber Cross Site Scripting XSS in ProfilePress = 4.16.13 versions...

EUVD-2026-32915

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes...

PT-2026-49436

Subscriber Cross Site Scripting XSS in ProfilePress = 4.16.13 versions...

CVE-2026-53519 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefi...

EUVD-2026-35397

TYPO3 CMS has Broken Access Control in its DataHandler...

INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator

An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service PhaaS platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle...

CVE-2026-45178

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial ...

EUVD-2026-36246

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...