Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.
CVE-2026-75969 is a critical vulnerability affecting PTZOptics cameras and their Firmware Upgrade Tool. It involves missing authentication in the firmware update mechanism, allowing unauthenticated users to install modified firmware without administrator credentials. This affects multiple PTZOptics camera models and versions prior to specified firmware releases. The vulnerability has a high CVSS score of 9.1, indicating severe risk.
CVE-2026-103444 is a low-severity stored cross-site scripting (XSS) vulnerability in the MediaWiki WikiForum extension maintained by The Wikimedia Foundation. It involves improper neutralization of script-related HTML tags, allowing potentially malicious scripts to be stored and executed in the context of the affected web pages. The vulnerability affects the master branch of the WikiForum extension. No specific affected versions or patch information is provided.
A vulnerability in Zammad GmbH's Zammad DEB and RPM packages allows a local attacker with write privileges as the unprivileged zammad service account to escalate to full root privileges. This occurs because service processes temporarily run as root and execute files writable by the zammad account before dropping privileges. The affected services automatically restart without administrator intervention, enabling rapid privilege escalation. Only DEB and RPM package installations are affected; source and official container image installations are not impacted. All released packaged versions from 1.5.0 up to but not including 7.2.2 and 7.1.0-alpha are vulnerable.
Zammad versions 6.3.0 through 6.5.3 contain a session hijacking vulnerability that can lead to remote code execution as the zammad user. Versions 7.0.0 through 7.1.2 also contain the bug, but it is not exploitable due to framework changes. The vulnerability has a high severity with a CVSS 4.0 score of 8.7.
A low-severity cross-site scripting (XSS) vulnerability exists in the MediaWiki Collection (Book) extension versions 1.43, 1.45, and 1.46. The issue involves improper neutralization of script-related HTML tags, allowing XSS targeting non-script elements. This vulnerability could potentially allow an attacker to inject malicious scripts into web pages generated by the affected extension versions.
CVE-2026-19553 is a vulnerability in Python's CPython ssl module where SSLContext.wrap_bio() does not require the server_hostname argument to be non-None when SSLContext.check_hostname is enabled. This causes hostname verification to be silently skipped if server_hostname is not supplied, potentially leading to a false sense of security. The issue affects multiple Python versions prior to specific fixed releases. Mitigation does not require patching but involves passing a valid non-empty server_hostname to relevant APIs. The patch changes the behavior to raise a ValueError instead of silently skipping verification.
CVE-2026-47603 is a medium severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves missing authorization checks in the kernel mode driver, allowing a local user to access another process's GPU channel state. This can lead to information disclosure but does not affect integrity or availability.
A vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux allows a local user to cause the kernel mode driver to dereference an untrusted pointer. Exploiting this flaw could result in denial of service and information disclosure. The vulnerability is classified under CWE-119, indicating improper restriction of operations within the bounds of a memory buffer. The CVSS v3.1 score is 7.1, reflecting high severity. No affected versions or patch information are provided.
CVE-2026-47601 is a high-severity out-of-bounds write vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It occurs in the open-source kernel module DMA-BUF import path, allowing an unprivileged local user to improperly preserve memory access permissions when importing a read-only buffer from another device's DMA-BUF exporter. Exploitation could lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering.
CVE-2026-47600 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves a use of an uninitialized resource in the kernel mode layer during error handling. Exploitation could lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high severity with a CVSS score of 7.8. No specific affected versions or patches are provided in the available data.
CVE-2026-47599 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It involves improper preservation of memory access permissions during DMA mapping in the open-source kernel module. This flaw allows an unprivileged local user to potentially execute code, escalate privileges, cause denial of service, disclose information, or tamper with data.
CVE-2026-47598 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver for Linux, specifically within the open-source kernel module's event delivery path. This flaw allows an unprivileged local user to trigger a race condition between asynchronous event delivery and file close. Exploitation could lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patch information are provided.
CVE-2026-47597 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver's open-source kernel module Resource Server for Windows and Linux. It allows an unprivileged local user to cause memory corruption due to a missing self-reference guard during map cleanup. The vulnerability has a high severity with a CVSS score of 7.8 and can potentially lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. No affected versions or patch information are provided in the available data.
CVE-2026-47595 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It involves improper preservation of memory permissions in the kernel mode layer, which allows an unprivileged user to write to read-only memory. This flaw can lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering.
CVE-2026-47592 is a high-severity out-of-bounds read vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It occurs in the kernel mode layer and can be triggered by an unprivileged user. Exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. No specific affected versions or patch information are provided.
CVE-2026-47591 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It is an incorrect authorization flaw in the kernel mode layer that allows an unprivileged user to bypass read-only memory protections and gain write access to memory that should be read-only. This vulnerability can lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.
CVE-2026-47589 is a use-after-free vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It can be triggered by an unprivileged user through a specific sequence of driver commands. Exploitation may lead to code execution, privilege escalation, denial of service, and information disclosure. The vulnerability has a high severity with a CVSS score of 7.8. No patch or remediation information is currently available.
CVE-2026-47588 is a use-after-free vulnerability in the NVIDIA GPU Display Driver for Linux affecting RTX, Quadro, and NVS products. An unprivileged user can trigger this flaw by issuing a sequence of driver commands. Successful exploitation could lead to code execution, privilege escalation, denial of service, and information disclosure. The vulnerability has a high severity score of 7.8. No specific affected versions or patch information is provided.
CVE-2026-47587 is a use-after-free vulnerability in the NVIDIA GPU Display Driver for Linux, impacting the RTX, Quadro, and NVS product lines. This vulnerability allows an unprivileged user to potentially execute arbitrary code, escalate privileges, cause denial of service, disclose information, or tamper with data. The vulnerability has a high severity score of 7.8. No specific affected versions or patch information are provided in the available data.