Memory Allocation with Excessive Size Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the checkforlanguage function. An attacker can exhaust system memory by submittin...

External Control of File Name or Path

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to External Control of File Name or Path via the GDALRaster constructor in spatial lookups. An attacker can write arbitrary files or...

Incorrect Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incorrect Authorization via the credential parameter in the affected API endpoints. An attacker can gain unauthorized access to credentials and perform actions in another workspace by supplying a known...

Eval Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Eval Injection via the CSVAgent process. An attacker can execute arbitrary code on the host system by injecting malicious input into the csvFile parameter, which is interpolated directly into...

External Control of File Name or Path

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to External Control of File Name or Path via the S3 Directory loader process. An attacker can write arbitrary files to locations outside the intended temporary directory by supplying crafted S3...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code...

Incomplete List of Disallowed Inputs

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through insufficient validation of environment variables in the validateEnvironmentVariables process. An attacker can execute arbitrary code with the privileges of the...

IxChariot Endpoint buffer overflow

RISK EVALUATION Keysight IxChariot Endpoint, Hawkeye, IxTap, IxByPass, and IxProbe contain one or more buffer overflow vulnerabilities. In the worst case, a remote unauthenticated attacker could execute arbitrary code. 2. RECOMMENDED PRACTICES Upgrade to latest versions. 3. DESCRIPTION Keysight...

Incorrect Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incorrect Authorization in the DELETE /api/v1/chatflows/:id process. An attacker can perform unauthorized deletion of resources by exploiting insufficient validation of permission scopes, allowing users wit...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input, which allows overriding the intended SQLite database path. An attacker can achieve arbitrary code execution by crafting a malicious...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input, which allows overriding the intended SQLite database path. An attacker can achieve arbitrary code execution by crafting a malicious payload that writ...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSVAgent process, where user-supplied input is used to construct Python code executed via pyodide. An attacker can execute arbitrary code by supplying a crafted payload that...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to CVE-2026-2332.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jetty-http-12.1.5.jar, jetty-http-12.1.6.jar which is vulnerable to CVE-2026-2332. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-2332...

Authorization Bypass Through User-Controlled Key

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the customerId parameter in the GET /api/v1/organization/customer-default-source endpoint. An attacker can access sensitive payment and profile informati...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358

Summary IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. CVE-2026-55831: resource exhaustion/DoS in...

SUSE-SU-2026:3482-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed - CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. - CVE-2026-55831: resource exhaustion/DoS in...

Security update for kubevirt

This update for kubevirt fixes the following issues: Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

AIOHTTP: HTTP request smuggling via WebSocket upgrade

SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...

PYSEC-2026-3546 AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...