Overview of incoming advisories.
2186 results found
A prototype pollution vulnerability (CVE-2026-78654) has been discovered in the cleverbrush framework and deep library up to version 4.4.0. The vulnerability exists in the deepExtend function within libs/deep/src/deepExtend.ts, allowing improperly controlled modification of object prototype attributes. Remote exploitation is possible and a public exploit has been disclosed. The vulnerability has been patched in version 4.4.1 with commit 810398c1308c500c3b8b6af380b5a89371389327. Users are strongly advised to upgrade the affected component immediately to mitigate risk.
View original advisory →CVE-2026-55620 affects the eml_parser Python library (versions prior to 3.0.2), which is used for parsing EML email files. The vulnerability exists in the eml_parser.routing.noparenthesis function in routing.py, where a regex-based fix-point loop processes parenthesized CFWS comments in Received headers with quadratic time complexity relative to nesting depth. An attacker can craft a small EML file containing deeply nested parentheses (e.g., 5,000 levels) to cause approximately 1.3 seconds of CPU saturation per message, with processing time quadrupling as nesting depth doubles. This ReDoS (Regular Expression Denial of Service) vulnerability can lead to worker latency, queue backpressure, and service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. The issue has been patched in eml_parser version 3.0.2. The fix is available via a GitHub commit and documented in a security advisory on GitHub.
View original advisory →CVE-2026-65081 is a high-severity vulnerability affecting NVIDIA NemoClaw for Linux. The flaw exists within the software's installation process, allowing an attacker to cause execution of untrusted code. A successful exploit could lead to multiple severe impacts including arbitrary code execution, escalation of privileges, data tampering, information disclosure, and denial of service. The vulnerability was reported via the NVD (National Vulnerability Database) and NVIDIA's product security advisory. No patch or mitigation details are explicitly provided in the article content. The vulnerability is classified as high criticality given the breadth of potential impacts. Organizations using NVIDIA NemoClaw on Linux systems should monitor NVIDIA's security advisories for updates and patches.
View original advisory →CVE-2026-65082 is a vulnerability in NVIDIA NemoClaw for Linux affecting its migration command. A local attacker can exploit this flaw to perform code injection. Successful exploitation may lead to arbitrary code execution, data tampering, information disclosure, and denial of service. The vulnerability is locally exploitable, meaning an attacker must have local access to the system. NVIDIA has published a security advisory via their product-security GitHub repository. The vulnerability is tracked on both the NVD and CVE.org databases. The severity is rated High based on the range of potential impacts. No patch or workaround details are provided in the article content itself.
View original advisory →Nokogiri versions prior to 1.13.5 contain an integer overflow vulnerability in the packaged libxml2 buffer handling functions. The flaw enables attackers to cause out-of-bounds memory writes by crafting multi-gigabyte XML files that trigger buffer overflows. Successful exploitation can lead to information disclosure, unauthorized data modification, or denial of service conditions. The vulnerability originates in the underlying libxml2 library bundled with Nokogiri, a widely used Ruby XML/HTML parsing library. A patch was issued in Nokogiri 1.13.5, and users are advised to upgrade immediately. The issue is tracked under CVE-2022-50999 and has been assigned a High criticality rating. Multiple references including a GitHub commit, a security advisory, and a VulnCheck entry document the vulnerability and its remediation.
View original advisory →CVE-2026-65097 describes a vulnerability in NVIDIA NemoClaw for Linux affecting its installation scripts. The flaw allows an attacker to trigger a download of code without integrity verification, commonly known as a 'download without integrity check' weakness. Successful exploitation could lead to arbitrary code execution, privilege escalation, information disclosure, and data tampering. The vulnerability resides specifically in the installation/setup phase of the software. NVIDIA has published a security advisory via their product-security GitHub repository. The vulnerability is rated high severity given the breadth of potential impact. Linux systems running NVIDIA NemoClaw are the primary affected targets. Users are advised to review NVIDIA's official advisory for patches and mitigations.
View original advisory →Nokogiri versions prior to 1.19.3 are vulnerable to Regular Expression Denial of Service (ReDoS) in the CSS selector tokenizer. The vulnerability affects string-literal and identifier tokenization within the library. Attackers can exploit this by injecting adversarial CSS selectors into methods such as Node#css, Node#at_css, and Searchable#search. This causes exponential regex backtracking, leading to denial of service conditions. The vulnerability is tracked as CVE-2026-79770 and has been patched in Nokogiri 1.19.3. Users of affected versions should upgrade immediately to mitigate the risk. The issue is documented across NVD, GitHub Security Advisories, and VulnCheck.
View original advisory →A vulnerability was discovered in the sos clean utility, part of the sos package used for system diagnostics. The flaw allows a local attacker to perform arbitrary file creation or overwrite by crafting a malicious tar archive. The vulnerability stems from improper validation of symlink and hardlink targets during tar extraction, enabling path traversal attacks. Since the sos clean process frequently runs with root privileges, a successful exploit can write files to any location on the system. This poses a significant privilege escalation and system integrity risk. The issue has been tracked and reported via Red Hat's Bugzilla and the upstream GitHub repository. Fixes are being addressed through a pull request in the sosreport/sos GitHub project. The vulnerability affects Linux systems running the sos package, particularly Red Hat-based distributions.
View original advisory →CVE-2026-13214 describes a stack buffer overflow vulnerability in the OCPP 1.6 client implementation within the Zephyr RTOS (subsys/net/lib/ocpp/ocpp_j.c). The vulnerable function parse_getconfig_msg() uses an unbounded strcpy() to copy an attacker-controlled JSON 'key' string into a fixed 50-byte stack buffer, with the key length only bounded by the receive buffer size of up to 2048 bytes. The vulnerability is exploitable by an attacker who controls the central system endpoint or performs a man-in-the-middle attack on an unencrypted WebSocket connection. Exploitation can result in a remotely triggerable stack smash on the OCPP reader thread, leading to at minimum denial of service and potentially remote code execution. The impact depends on build-time hardening measures such as stack canaries and MPU configuration. The fix involves replacing strcpy() with a bounded strncpy() call with explicit NUL termination, consistent with other sibling handler implementations.
View original advisory →CVE-2026-14457 is a NULL pointer dereference vulnerability (CWE-476) in OpenSSL affecting server and client configurations using RFC7250 Raw Public Keys (RPKs) with only a private key configured and no associated certificate. The flaw is triggered when a remote peer solicits raw public keys and sends the typically omitted 'signature_algorithms_cert' TLS extension, causing an application abort. The impact is limited to a Denial of Service; no data disclosure or remote code execution is possible. Configurations that include both a private key and a matching certificate are not affected. FIPS modules are unaffected as the SSL implementation is outside the OpenSSL FIPS module boundary. The recommended mitigation is to always configure a corresponding certificate alongside the private key, or to upgrade to a patched release. Multiple commits have been issued across OpenSSL branches to address the issue.
View original advisory →CVE-2026-63586 describes a critical OS command injection vulnerability in a web-based management interface running a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username field is taken directly from the Authorization header without any sanitization and is inserted into a shell command executed via the system() function. An unauthenticated attacker with network access can craft a malicious username containing shell metacharacters to escape the command context and execute arbitrary commands with root privileges. No authentication is required to exploit this vulnerability. The flaw is classified as a pre-authentication remote code execution (RCE) issue. It affects embedded or IoT-class devices using this management interface. Advisories have been published by NVD and CERT VDE.
View original advisory →CVE-2026-55527 affects PraisonAI, a multi-agent teams system, in versions prior to praisonaiagents 1.6.58. The vulnerability exists in the FileMemory constructor, which joins an unsanitized user_id parameter into self.user_path without proper validation. An attacker supplying path traversal sequences such as '../' or other path separators can escape the intended memory directory boundary. This allows writing arbitrary JSON data to any location writable by the process, potentially enabling unauthorized file writes across the filesystem. The vulnerability is classified as a path traversal (directory traversal) issue. The fix was implemented by sanitizing the user_id input before it is used to construct self.user_path. The issue has been patched in version 1.6.58 of praisonaiagents, with the fix committed to the official GitHub repository.
View original advisory →Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability tracked as CVE-2026-76193. The vulnerability can result in arbitrary code execution in the context of the current user. No user interaction is required for exploitation, making it particularly dangerous. The scope of the vulnerability is marked as changed, indicating impact can extend beyond the vulnerable component. Adobe has published a security advisory (APSB26-134) addressing this issue. The vulnerability is rated with a high criticality level. Organizations using Adobe Campaign Classic should apply patches or mitigations as soon as possible to reduce exposure.
View original advisory →CVE-2026-55609 is a path traversal vulnerability affecting the sublinear-time-solver Rust/WebAssembly library and its consciousness-explorer component. The export_state, import_state, saveVectorToFile, and loadVectorFromFile MCP tools pass attacker-controlled filepath parameters directly to filesystem operations without sanitization or traversal restrictions. An attacker capable of invoking these MCP tools can read, write, or overwrite any file accessible to the server process. This leads to confidentiality and integrity loss and potential service disruption. The vulnerability exists in src/consciousness-explorer/mcp/server.js and src/mcp/server.ts. Fixes are available in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0. Multiple GitHub commits and a pull request address the remediation.
View original advisory →A Server-Side Request Forgery (SSRF) vulnerability exists in PraisonAI's multi-agent system prior to version praisonaiagents 1.6.58. The web_crawl function validates only the initial URL but uses httpx.Client with follow_redirects=True, meaning redirect targets are never revalidated. An attacker who can influence a crawl target can craft a redirect from a public URL to internal loopback addresses, private network ranges, or cloud metadata services (e.g., AWS IMDSv1). This bypass works even when ALLOW_LOCAL_CRAWL is disabled, as the security check only applies to the initial URL. The internal response content is returned directly to the agent context, potentially exposing sensitive infrastructure data. The vulnerability is fixed in praisonaiagents version 1.6.58.
View original advisory →NLTK versions before 3.10.3 contain a server-side request forgery (SSRF) vulnerability in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. The vulnerability arises because pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers, causing the actual fetch to be performed by the proxy without re-validation of the destination. An attacker can supply a publicly validated URL that the proxy then forwards to an internal loopback-only service. This allows disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content. The flaw represents a significant supply chain risk for Python NLP environments using NLTK with proxy configurations. Users are advised to upgrade to NLTK 3.10.3 or later to mitigate the vulnerability.
View original advisory →OpenEXR, the reference implementation for the EXR image format widely used in the motion picture industry, contains a vulnerability in multiple versions. Affected versions include those before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The flaw resides in the TypedDeepImageChannel::row() function, which can return an out-of-bounds pointer when processing a crafted deep EXR file with a nonzero dataWindow origin. The root cause is an API design issue where zero-based row access is combined with an absolute-coordinate-adjusted base pointer. Exploitation of this vulnerability can lead to application crashes or limited information disclosure. Fixed versions are 3.2.11, 3.3.13, and 3.4.14. Multiple commits have been published to the OpenEXR GitHub repository addressing this issue. A GitHub Security Advisory (GHSA-6662-fq6f-93mp) has also been published.
View original advisory →CVE-2026-65090 is a vulnerability in NVIDIA NemoClaw for Linux affecting the NIM management component. The flaw allows an attacker to perform OS command injection through the affected component. Successful exploitation could lead to arbitrary code execution, data tampering, information disclosure, and denial of service. The vulnerability is rated as high severity. NVIDIA has published a security advisory through their product-security GitHub repository. The issue is tracked in both the NVD and CVE databases. No additional technical details or proof-of-concept exploits are currently disclosed in the article. Users of NVIDIA NemoClaw on Linux should monitor for patches and apply mitigations as soon as they become available.
View original advisory →CVE-2026-55582 affects mcp-shell, an MCP server for running shell commands securely. Prior to version 0.6.0, the default security.yaml configuration permits /usr/bin/git, while the security.go file fails to include the '!' character in its shell metacharacter and dangerous construct checks. This oversight, combined with no per-executable argument policy, allows an attacker to pass a crafted Git -c alias argument to execute arbitrary OS commands. The exploit leverages Git's alias feature with shell escape syntax (!<command>) to bypass security controls. The default Docker deployment runs as mcpuser with Git installed and secure mode enabled, making it exploitable without additional authentication beyond MCP connectivity. The vulnerability is exploitable in default configurations, raising its risk profile significantly. The issue has been patched in version 0.6.0 of mcp-shell. Users are advised to upgrade immediately to mitigate the risk of arbitrary command execution.
View original advisory →CVE-2026-65099 is a vulnerability in NVIDIA NemoClaw for Linux affecting its command-line interface. The flaw allows an attacker to perform OS command injection through the CLI. Successful exploitation can lead to arbitrary code execution on the affected system. Additionally, the vulnerability may result in data tampering, undermining data integrity. Information disclosure is also a potential consequence, exposing sensitive data. Denial of service attacks are possible, disrupting system availability. NVIDIA has published an advisory on their product-security GitHub repository. The vulnerability is tracked on both NVD and CVE.org. No active exploitation details are mentioned in the advisory at this time.
View original advisory →