CVE watch

CVE-2026-107291 published: Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive ...

CVE-2026-105828 published: Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding ...

CVE-2026-105827 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105826 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105825 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105824 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105823 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105405 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105404 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105403 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105402 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105401 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105400 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105399 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105398 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105331 published: Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

CVE-2026-104634 published: Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema....

CVE-2026-103663 published: Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a maliciou...

CVE-2026-102784 published: Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads...

CVE-2026-102783 published: Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then r...