Total
382 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-54981 | 1 Microsoft | 2 Python, Visual Studio Code | 2026-10-24 | N/A | 7.8 HIGH |
| Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-55522 | 2026-10-24 | N/A | 7.8 HIGH | ||
| PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents. | |||||
| CVE-2026-47781 | 2026-10-24 | N/A | N/A | ||
| PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0. | |||||
| CVE-2026-71471 | 2026-10-24 | N/A | 9.0 CRITICAL | ||
| A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters. | |||||
| CVE-2026-73851 | 2026-10-24 | N/A | N/A | ||
| Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0. | |||||
| CVE-2026-64808 | 1 Jetbrains | 1 Phpstorm | 2026-10-24 | N/A | 8.4 HIGH |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling | |||||
| CVE-2026-64809 | 1 Jetbrains | 1 Phpstorm | 2026-10-24 | N/A | 8.4 HIGH |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter | |||||
| CVE-2026-64805 | 1 Jetbrains | 1 Webstorm | 2026-10-24 | N/A | 8.4 HIGH |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling | |||||
| CVE-2026-64807 | 1 Jetbrains | 1 Webstorm | 2026-10-24 | N/A | 7.8 HIGH |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration | |||||
| CVE-2026-64811 | 1 Jetbrains | 1 Intellij Idea | 2026-10-24 | N/A | 7.8 HIGH |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration | |||||
| CVE-2026-65908 | 1 Jetbrains | 1 Pycharm | 2026-10-24 | N/A | 8.6 HIGH |
| In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | |||||
| CVE-2026-64806 | 1 Jetbrains | 1 Webstorm | 2026-10-24 | N/A | 8.4 HIGH |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter | |||||
| CVE-2026-64804 | 1 Jetbrains | 1 Webstorm | 2026-10-24 | N/A | 8.4 HIGH |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling | |||||
| CVE-2026-73367 | 2026-10-23 | N/A | 7.2 HIGH | ||
| Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | |||||
| CVE-2024-32011 | 2026-10-23 | N/A | 8.8 HIGH | ||
| A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user. | |||||
| CVE-2026-67623 | 2026-10-23 | N/A | 8.8 HIGH | ||
| Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository. | |||||
| CVE-2026-113461 | 2026-10-23 | N/A | N/A | ||
| Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled. | |||||
| CVE-2026-96237 | 2026-10-22 | N/A | 7.5 HIGH | ||
| Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-113709 | 2026-10-21 | N/A | 9.9 CRITICAL | ||
| Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. | |||||
| CVE-2026-15560 | 2026-10-20 | N/A | 8.1 HIGH | ||
| when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run. | |||||