PT-2026-67610

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC ENDPOINTS list with a TODO comment acknowledging it...

arkindex-base-worker (>=0.2.1, <=0.3.0rc5), candyshop (>=0.2.0, <=0.2.2) +8 more potentially affected by CVE-2026-54552 via sh (1.14.2)

sh PYPI version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - arkindex-base-worker =0.2.1, =0.2.0, =0.0.2, =4.3.0a1, =0.1.1.1, =1.0.1, =2.0.0rc3, =2.0.0rc4 Source cves: CVE-2026-54552 Source advisory: OSV:PYSEC-2026-3...

PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Service Worker mechanism in Google Chrome before version 148.0.7778.179 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

RHSA-2026:42946 Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

AZL-92982 CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

ALPINE-CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

EUVD-2026-47676

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

Important: Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SUSE CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

abraia (>=0.8.0, <=0.8.9), arcor2 (>=0.19.0, <=0.21.0) +53 more potentially affected by CVE-2026-59197 via pillow (8.3.1)

pillow PYPI version 8.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.0, =0.19.0, =0.17.0, =0.12.0, =0.13.0, =2.0.0, =0.0.1, =3.0.0b34, =3.0.1b6 and more Source cves: CVE-2026-59197 Source advisory:...

3deecelltracker (0.5.0a0), aima (2023.2.4) +60 more potentially affected by CVE-2026-55379 via pillow (9.1.0)

pillow PYPI version 9.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker 0.5.0a0 - aima 2023.2.4 - an-website =22.5.13, =2.4.5, =0.2.4rc1, =22.14.1, =0.0.3, =1.0.1, =0.1.0, =0.0.36, =0.0.39 and more Source...

3deecelltracker (0.5.0a0), aima (2023.2.4) +60 more potentially affected by CVE-2026-54060 via pillow (9.1.0)

pillow PYPI version 9.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker 0.5.0a0 - aima 2023.2.4 - an-website =22.5.13, =2.4.5, =0.2.4rc1, =22.14.1, =0.0.3, =1.0.1, =0.1.0, =0.0.36, =0.0.39 and more Source...

BIT-NGINX-GATEWAY-2026-56434 NGINX ngx_http_ssi_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

BIT-NGINX-2026-60005 NGINX ngx_http_slice_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

Important: Red Hat Security Advisory: Satellite 6.16.11 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...