All items

CVE-2026-118627 is a remote code execution flaw in MLflow's SHAP load_explainer, caused by deserialization of untrusted data. An attacker can run arbitrary code in the context of the current user on affected installations, but only if the target visits a malicious page or opens a malicious file. The flaw lies in the loading of SHAP explainer models, which lacks proper validation of user-supplied data. Reported as ZDI-CAN-30301.

A missing authorization flaw in the MLflow Tracking Server lets a remote attacker escalate privileges on affected installations. The specific flaw exists in the configuration of BEFORE_REQUEST_HANDLERS, where access to functionality is granted without an authorization check. Exploitation requires authentication, and the issue is tracked as ZDI-CAN-32108.

CVE-2026-118625 is a missing authorization flaw in the MLflow Tracking Server. The flaw sits in the get_endpoints function, which grants access to functionality without an authorization check. A remote attacker who has authentication can use it to escalate privileges to resources normally protected from that user.

CVE-2026-118623 is a remote code execution flaw in MLflow's PickleEvaluationArtifact component. The flaw sits in the parsing of pickle files, which lacks proper validation of user-supplied data and leads to deserialization of untrusted data. An attacker who gets a target to visit a malicious page or open a malicious file can execute code in the context of the current process.

Claude Code versions before 2.1.251 have a flaw in the Edit tool, which validates target paths by pathname and symlink resolution without binding them to the directory inode or file descriptor. On macOS, code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, so the unsandboxed Edit implementation overwrites a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script.

Claude Desktop on Windows, prior to 1.8089.0, calls git.exe through uv_spawn without an absolute path. Windows search-path resolution can therefore pick a malicious git.exe placed in the opened project's current working directory, so opening an attacker-controlled or shared repository executes the substituted program with the user's privileges.

CVE-2026-115413 affects the AWS API MCP Server in versions >=1.3.0 and <1.6.0 when it runs the streamable-http transport with OAuth authentication. The server checks a bearer token's signature, issuer and expiry but not the application audience claim, so a token issued to another application in the same tenant is accepted. This may allow AWS API calls using the credentials configured on the host.

CVE-2026-89229 is a path traversal flaw (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot). A malicious application installed on the same device can send a crafted ACTION_SEND intent whose ContentProvider-supplied file name contains '..' sequences, allowing it to write arbitrary files.

CrewAI has an SSRF vulnerability because its SSRF guard and HTTP client check different content in a URL. Any request that injects a malicious URL can trigger SSRF, including through ScrapWebsiteTool.

OpenAirInterface Core Network v2.2.1 contains a stack-based buffer overflow in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which writes arbitrary-length hex strings into fixed-size stack buffers without checking the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.

The Linux kernel io_uring subsystem contains a flaw in io_waitid, where repeated failed cancellation attempts increment the 31-bit reference field in ->refs. The counter can wrap to zero, letting a later cancellation claim ownership and complete the request a second time.

TAKO AI Agent for Okta, prior to 3.0.1-beta, lets any authenticated user with a valid `fctr_session` cookie submit arbitrary Python through `POST /api/react/execute-script`, without administrator privilege. The `script_code` bypasses AI content filtering and passes an AST check that misses dynamic `getattr` call chains through `__builtins__`, then runs as root in the default container, enabling disclosure of Okta API tokens, the JWT key and the SQLite database, plus backend pivoting and persistence.

node-forge's forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero or less, causing pkcs12.generateKey-style key derivation to return a constant key independent of password and salt. An attacker without the password can forge a PFX MAC that verifies with any password, and PKCS#12 PBE-encrypted private keys decrypt with any password. Affected versions are node-forge 1.4.0 and earlier.

@sigstore/oci attaches the registry Authorization header as a default on its shared client in signIn(). In uploadBlob(), the blob is PUT to the Location header value returned by the registry without checking that its host matches the registry host, so the credential is sent to any host the registry names. The source describes this as a residual of GHSA-pf56-329r-95rw / CVE-2026-59891, whose fix only changed credential selection in credentials.ts and did not touch registry.ts.

LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers, before versions 4.7.1 and 5.0.1. `XMLSecurityDSig::validateReference()` resolves `Reference URI="#id"` document-wide and takes `item(0)`, so an attacker can place a genuine signed assertion's bytes in `samlp:Extensions` and present a forged direct-child assertion with the same ID. Validation covers the hidden bytes while LightSAML consumes unsigned `Subject/NameID`, `Conditions` and `Attributes`, enabling authentication bypass or privilege escalation. Confirmed in 5.0.0 and 4.6.1.

RAGFlow versions 0.25.2 through 0.27.3 call completion_openai in POST /api/v1/agents/chat/completions before UserCanvasService.accessible() checks access to the requested agent. An authenticated user who knows another user's private agent UUID can run that Only me workflow and read its output across user or tenant boundaries, and configured tools may cause side effects, though stronger impacts were not demonstrated.

praktor, a multi-agent Claude Code orchestrator with Telegram input, has a path traversal flaw in both Telegram upload sites in `internal/telegram/bot.go` before 0.9.1. The attacker-controlled document filename is concatenated into the destination path without sanitization, and `path.Join` collapses parent-directory traversal, so a remote Telegram user can write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. With `allow_from: []`, which permits all senders by default, no authentication is needed, and the attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook or configuration files that the agent reads on later runs. The demonstrated write scope is the workspace volume, not the unrestricted host filesystem.

Flowise through 3.1.4 has a sandbox escape (CVE-2026-119978) that lets authenticated users run OS commands when ALLOW_BUILTIN_DEP=true. Attackers submit JavaScript to /api/v1/node-custom-function that uses LocalFileStore to write a file into the mammoth package and then require it, escaping vm2 as the Flowise process user.

DBHub, a database MCP server, versions prior to 0.22.6 contain a flaw where read-only SQL validation can be bypassed on its MySQL and MariaDB connectors. The `scanSingleLineComment` function in `src/utils/sql-parser.ts` treats any double dash as a comment, while MySQL and MariaDB require following whitespace, so a hidden write or DDL statement evades `isReadOnlySQL` and still executes with `multipleStatements` enabled. An attacker who can influence the assistant's SQL, including via prompt injection, can modify or drop data within the database account's privileges. PostgreSQL is not affected.

Prior to version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints in backend/app/incidents/routes/incident_alert.py lack role and tenant authorization, and POST /api/incidents/alerts/create/velo-sigma/exclusion does not validate credentials. Because return_username_for_logging passes invalid, expired or forged token strings through instead of rejecting them, an attacker can create suppression rules that drop matching alerts before incident creation, including platform-wide rules when customer_code is null. Low-privilege customer_user accounts can also read, modify, disable or delete any exclusion.