CVE-2026-54529 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2026-54529

SQLAdmin , a Python admin interface for SQLAlchemy models, is vulnerable to an information-exposure ordering oracle via the unvalidated sortBy query parameter in ModelView.sort_query() (prior to 0.27.1 ). The root cause is that column_sortable_list is enforced only in the frontend template to dec...

CVE-2026-57115

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrapepage validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without...

CVE-2026-57145 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...

CVE-2026-82426 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82426

The Apache Storm Nimbus component is vulnerable to an arbitrary file read because it accepts the uploadedJarLocation argument from submitTopology and submitTopologyWithOpts as a raw server-side path. The system fails to verify if the path refers to a file actually uploaded by the caller, allowing...

CVE-2026-82441

Apache Storm Nimbus is vulnerable to cross-tenant blob deletion and a cluster denial of service due to improper validation of dependency_jars and dependency_artifacts keys in submitted topologies. Because Nimbus performs no validation on the submission path, a malicious submitter can list keys be...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

EUVD-2026-77486

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected MariaDB installations. Exploiting this vulnerability requires interaction with the mariadb-dump utility, but the attack vectors ma...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with an unvalidated length at nfsreadlinkreply, located in the “if” block, after calculating the new path length...

Astra Linux – Vulnerability in openexr

In the ImfChromaticities.cpp routine, within the RGBtoXYZ function, there are some division operations such as float Z = 1 - chroma.white.x - chroma.white.y Y / chroma.white.y; and chroma.green.y X + Z / d;. However, the divisor is not checked for a 0 value. A specially crafted file could trigger...

Astra Linux – Vulnerability in Linux 5.10, Linux

A NULL pointer dereference flaw was discovered in the az6027 driver, located in the file drivers/media/usb/dev-usb/az6027.c within the Linux Kernel. The message from the user space is not properly checked before being transferred to the device. This flaw could allow a local user to crash the syst...

Astra Linux – Vulnerability in Poppler

A issue was discovered in Poppler 0.71.0. There is an out-of-bounds read in EmbFile::save2 in FileSpec.cc, which can lead to a denial of service. This issue is evident when utils/pdfdetach.cc does not validate embedded files before attempting to save them...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the ecamencodercompressh264 function relied on server-controlled dimensions and did not validate the source buffer size, resulting in a out-of-bounds read in swsscale. This vulnerability has been fixed in...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in OVN

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header’s self-declared total length iptotlen for IPv4, ip6plen for IPv6, without validating it against the actual packet buffer siz...

CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...

CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...