UBUNTU-CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

GHSA-8PPF-4F7H-5PPJ vulnerabilities

Vulnerabilities for packages: kserve, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, k8s-sidecar, kubeflow-jupyter-web-app, mlflow, superset, mitmproxy, kubeflow-pipelines, datadog-agent, py3-cassandra-medusa, airflow...

CVE-2026-59886 vulnerabilities

Vulnerabilities for packages: kserve, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, k8s-sidecar, kubeflow-jupyter-web-app, mlflow, superset, mitmproxy, kubeflow-pipelines, datadog-agent, py3-cassandra-medusa, airflow...

GHSA-HM4W-WWCW-MR6R vulnerabilities

Vulnerabilities for packages: kserve, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, k8s-sidecar, kubeflow-jupyter-web-app, mlflow, superset, mitmproxy, kubeflow-pipelines, datadog-agent, py3-cassandra-medusa, airflow...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: httpie, kubeflow-volumes-web-app, kubeflow-katib, py3-pipenv, kubeflow-jupyter-web-app, py3-setuptools, mlflow, pypy-3.10, superset, datadog-agent, airflow...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: httpie, kubeflow-volumes-web-app, kubeflow-katib, py3-pipenv, kubeflow-jupyter-web-app, py3-setuptools, mlflow, pypy-3.10, superset, datadog-agent, airflow...

CVE-2026-57784

creationtimestamp| type| source ---|---|--- 2026-07-23 12:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvbbtcr72s...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

CVE-2026-60150

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

PYSEC-2026-3490 NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...

PYSEC-2026-3537 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

PYSEC-2026-3513 praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...

PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

CVE-2026-65550

Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.

Astra Linux – Vulnerability in Chromium

Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Persistent Cache of Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...