This week

AI summaryUnder certain conditions, an integer overflow in GitLab CE/EE 19.2–19.4 before patches may let authenticated users run code on the server.

AI summaryGitLab CE/EE 18.3+ before fixes may let authenticated users with MCP-scoped tokens act beyond the token's intended scope.

AI summaryA race condition in GitLab CE/EE's MCP search tool (18.6 through pre-19.4.1) could return search results under the wrong user context.

AI summaryUnder certain conditions, a double free in GitLab CE/EE 19.2–19.4 before patches may let authenticated users run code on the server.

AI summaryLaravel-Mediable 7.0.0–7.0.1 misses .pht in its upload blocklist (incomplete CVE-2026-49972 fix), so Apache may run such files as PHP.

AI summaryMLflow's statsmodel flavor (2.1.0–3.14.0) ignores the pickle-blocking setting, so a crafted MLmodel artifact can run arbitrary code.

AI summaryMLflow's dspy flavor (2.0+) enforces its pickle-blocking setting only for .pkl paths, so a crafted MLmodel artifact can run code.

AI summaryorval before 8.29.0 doesn't escape operationId, so crafted OpenAPI specs can inject JavaScript into generated query hooks.

AI summary@orval/core before 8.28.0's form-data serializer doesn't escape property names, so crafted OpenAPI specs can inject code.

AI summaryorval before 8.29.0 doesn't escape OpenAPI media-type keys, letting crafted specs inject JavaScript into generated fetch or mock code.

AI summaryorval before 8.30.0's @orval/core doesn't escape date defaults, so crafted OpenAPI specs can inject code into generated output.

AI summaryorval 8.14.0–8.28.1's @orval/effect generator lets crafted OpenAPI schema defaults inject JavaScript that runs in generated code.

AI summaryorval before 8.29.0's @orval/hono generator doesn't escape OpenAPI paths, so a crafted spec can inject code into generated output.

AI summaryIBM FTM for Red Hat OpenShift's AI agent server lets unauthenticated users insert runbook content into its vector DB to steer the agent.

AI summaryIf a developer runs flatpak build-init with a malicious SDK's extension, files may be written outside the working directory.

AI summaryLightLLM through 1.2.0, when run with --pd_trans_mode nccl, exposes an unauthenticated RPyC channel allowing remote code execution.

AI summarySunEditor before 2.47.11 fails to strip event-handler attributes from crafted custom/namespaced elements, risking XSS in apps using it.

AI summaryPlug decodes nested query/body parameters in quadratic time, letting crafted requests cause denial of service in apps using Plug.

AI summaryApache Tomcat Native from 2.0.0 enables insecure TLS options by default, such as client renegotiation, weakening connection security.

AI summaryApache Tomcat 9.0, 10.1 and 11.0 (up to 9.0.121/10.1.59/11.0.25) allow WebSocket message smuggling when per-message-deflate is used.

AI summaryA regression in Apache Tomcat 11.0.22+ and 10.1.55+ HTTP/2 handling can mix up request headers (request smuggling).

AI summaryIn some Apache Tomcat 9.0, 10.1 and 11.0 versions, CLIENT_CERT authentication may not fail as expected when soft fail is disabled.

AI summaryApache Tomcat 9.0.0.M1–9.0.121, 10.1.0-M1–10.1.59 and 11.0.0-M1–11.0.25 let WebSocket endpoint security constraints be bypassed.

AI summarymcp-toolbox-sdk-python's toolbox-core reuses one cached Google ID token across audiences; affects apps using 2+ audiences in one process.

AI summaryopenCode v1.18.26's Worktree.remove lacks path validation, letting attackers trigger arbitrary recursive directory deletion.

AI summaryAn out-of-bounds write in the lwIP TCP/IP stack's MQTT component may let an attacker fully execute code on affected devices.

AI summarySolarWinds Observability Self-Hosted allows unauthenticated remote code execution, but only in non-default, non-secure configurations.

AI summaryMoonshot AI Kimi Code up to 0.31.0 has an OS command injection flaw in its MCP configuration loader, reportedly remotely triggerable.

AI summarylightrag-hku has no rate limiting on its /login endpoint, allowing password brute-force attempts.

AI summaryAnyIO before 4.14.2 may check internationalized hostnames in connect_tcp()/TLSStream.wrap() using IDNA 2003 instead of IDNA 2008.

AI summaryBIG-IP APM configured as an OAuth Authorization Server with an access policy may allow remote code execution via malicious traffic.

AI summarySGLang's disaggregated-diffusion DiffusionServer exposes an unauthenticated ZeroMQ socket, enabling unauthenticated code execution.

AI summaryweb.py 0.76 doesn't check session age on load, so expired sessions not yet cleaned up may still be accepted.

AI summaryNVIDIA NeMo's dataset loading can accept unsafe parameters from a crafted model_config.yaml, possibly leading to code execution.

AI summaryA directory traversal and file upload flaw lets unauthenticated attackers upload and run scripts on Check Point Management Server.

AI summaryErlang/OTP ssl TLS 1.3 clients may finish a handshake without validating the server, letting a responding peer impersonate it.

AI summaryOn-prem VeloCloud Orchestrator may let a remote attacker access privileged internal functions and compromise the orchestrator host.

AI summaryA VPN certificate validation flaw in Check Point Quantum Security Gateway may let unauthenticated remote attackers run code on it.

AI summarygray-matter (all versions, verified 4.0.3) uses eval() to parse JavaScript front matter, allowing arbitrary code execution.

AI summaryMaxKB before 2.10.5-lts lets authenticated workspace members inject control characters into the server's AWS credentials file.

AI summaryMaxKB before 2.10.5-lts exposes a shell execute tool without human approval to assistants that have tools, MCP tools, skills or sub-apps.

AI summaryMaxKB 2.10.2-lts and earlier don't check API key expiry on /chat/api/mcp, so expired non-permanent keys may still authenticate.

AI summaryMaxKB 2.0.0–2.9.2 lets lowest-role workspace members run tools they were denied by binding tool IDs in agents or workflows.

AI summary@roomi-fields/notebooklm-mcp's vault.batch tool has a path traversal allowing files to be written outside the intended vault directory.

AI summaryOn Windows, Perl's Email::Sender::Transport::Sendmail before 2.602 may run arbitrary commands via envelope addresses reaching a shell.

AI summaryMINA's fix for CVE-2026-47065 (acceptMatchers filter bypass) was only committed to 2.2.X, so 2.0.X/2.1.X releases may lack it.

AI summaryMCP-for-Stata before 1.19.0 puts unvalidated input from its ado_package_install tool into Stata commands, enabling command injection.

AI summaryZyxel GS1900-48HPv2 firmware ≤2.90(ABTQ.1)C0 has a CGI stack overflow that may let unauthenticated LAN attackers run OS commands.

AI summaryLMDeploy 0.12.1–0.12.2 can run arbitrary Python code when loading a malicious HuggingFace model, due to code injection in config.py.

AI summaryLMDeploy deserializes pickle data in handle_zmq_recv (disaggregation engine connection), allowing remote code execution.

AI summaryLinux kernel TLS (kTLS) receive code mishandles zero-length records on the rx_list; affects systems using kernel TLS.

AI summaryAn out-of-bounds write in the Linux kernel; the affected component and impact details are unknown from the data provided.

AI summaryA race condition in the Linux kernel; the affected component and impact details are unknown from the data provided.

AI summaryAcronis Backup has incorrect default permissions; affected versions and impact details are not given.

AI summaryvm2 3.11.3–3.11.6 exposes the host's real https.globalAgent to sandboxed code when a NodeVM allows require('https').