A critical vulnerability exists in Red Hat AI Inference 3.5.3 (ROCm) involving the vLLM component. The system downloads and decodes remote or embedded media files before enforcing size and quantity restrictions, allowing a remote attacker to submit excessively large or numerous media payloads. This can cause resource exhaustion, leading to denial of service (DoS) by crashing or rendering the inference service unresponsive. The flaw does not allow code execution or data exposure but disrupts service availability. Mitigations include restricting network access to the inference service, blocking outbound connections to prevent fetching untrusted media, and enforcing request size limits at upstream proxies.
CVE-2026-95733 is a critical vulnerability in HPE Networking Fabric Composer involving the use of hardcoded credentials. An unauthenticated attacker on an adjacent network could exploit this flaw to execute arbitrary code on the affected system, potentially leading to full compromise. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0.
CVE-2026-95732 is a critical authentication bypass vulnerability in the underlying operating system of HPE Networking Fabric Composer. This flaw allows an unauthenticated adjacent attacker to execute arbitrary code on the affected system, potentially leading to full compromise. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive.
CVE-2026-95731 is a critical vulnerability in HPE Networking Fabric Composer's command-line interface involving hardcoded passwords. This flaw allows unauthenticated remote attackers to gain unauthorized administrative access with elevated privileges. The affected versions include 7.0.0 through 7.3.4 and version 7.4.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
CVE-2026-63469 is a critical code injection vulnerability in koxudaxi fastapi-code-generator versions prior to 0.8.1. The tool generates FastAPI applications from OpenAPI files and improperly inserts response status-code keys as single-quoted Python strings without escaping embedded quotes. This allows an attacker to inject arbitrary Python code if they control or influence a secondary response key in a multi-response operation. The injected code executes with the privileges of the application or CI process importing the generated module. The issue is fixed in version 0.8.1.
fastapi-code-generator versions prior to 0.8.1 contain a code injection vulnerability where unescaped triple quotes in Operation.summary allow injection of Python code into generated route-handler docstrings. This can lead to execution of attacker-controlled code with server process privileges when the affected route handler is invoked. The issue is fixed in version 0.8.1.
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Multiple critical authentication bypass vulnerabilities have been identified in the pyjwt library used by the fence-agents packages in Red Hat Enterprise Linux 9.2. These vulnerabilities include acceptance of empty HMAC keys, improper public key validation, acceptance of DER public keys as HMAC secrets, unvalidated JWKS redirects, and token forgery via improper Unicode byte-order mark handling. The fence-agents packages manage remote power control for cluster devices, making these vulnerabilities significant for cluster security. Red Hat has released security updates addressing these issues.
A Zip Slip vulnerability exists in the /upload endpoint of codeskyblue gohttpserver versions through 1.3.0. This flaw allows attackers to write arbitrary files on the server by uploading a specially crafted Zip archive.
SolarWinds Dameware contains a command injection vulnerability (CVE-2026-28336) that requires authentication and could allow an attacker to compromise a remotely controlled host. The vulnerability has a critical CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
A vulnerability in im3x Scriptables through the v2-dev branch allows attackers to inject arbitrary operating system commands by uploading a file with a specially crafted filename to the /sync endpoint. This could enable unauthorized command execution on the affected system.
An unauthenticated attacker with network access to SonicWall GMS versions 9.5.2 and earlier may read internal files, potentially exposing sensitive information. This vulnerability has a high impact on confidentiality and availability.
A critical code injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 Build 202004151405. The flaw is in the loadstring function of the Lua Handler component, allowing remote attackers to execute arbitrary code. Exploit code has been published, but the vendor has not responded or issued a fix.
This security update for rqlite addresses multiple issues including a security vulnerability related to authentication files that could allow a user with no explicit permissions to gain elevated permissions. The update also improves error handling for various API endpoints, fixes authorization and backup stream handling issues, and includes multiple implementation changes and bug fixes. Correctly configured users are not affected by the elevated permissions issue. The update spans versions from 10.0.2 through 10.6.6 with various incremental fixes and improvements.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.