CVE-2026-54746

Hatchet (a platform for orchestrating background tasks, AI agents, and durable workflows) is affected by a cross-tenant write/DoS vulnerability in the Dispatcher gRPC service . From version 0.40.0 to 0.91.1 , the UpsertWorkerLabels and Unsubscribe RPCs do not verify that the worker_id in the requ...

CVE-2026-79717 Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

A server-side request forgery SSRF vulnerability was found in galaxyng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata...