AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

All advisories

Medium advisories

6,389 medium severity advisories, newest first

60 of 6,389 advisories

Medium 6.4Nov 9Issues with Amazon Braket SDKAWSCVE-2026-124034no fix yetMedium 6.4Nov 9Relative path traversal in the log export commands in AWS ParallelCluster CLIAWSCVE-2026-124033no fix yetMedium 5.4Nov 3Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingAWSCVE-2026-121652no fix yetMedium 6.5Nov 2Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...AWSCVE-2026-105811no fix yetMedium 5.0Nov 2Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...AWSCVE-2026-120497no fix yetMedium 6.1Nov 2Improper limitation of a pathname to a restricted directory in the deployment status...AWSCVE-2026-116635no fix yetMedium 6.5Oct 30Insertion of sensitive information into a log file and process argument list in the...Amazon Kinesis Producer Library for JavaCVE-2026-119117no fix yetMedium 6.5Oct 30Missing type validation in xQueueSelectFromSet in FreeRTOS-KernelAWSCVE-2026-119086no fix yetMedium 6.3Oct 28mem0: information disclosuremem0CVE-2026-116575fixed in 2.0.18Medium 6.2Oct 28ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankONNXCVE-2026-115920fixed in 1.22.0Medium 6.2Oct 28ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsONNXCVE-2026-115922fixed in 1.22.0Medium 6.2Oct 28ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required AttributeONNXCVE-2026-115921fixed in 1.22.0Medium 6.2Oct 28ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)ONNXCVE-2026-115919fixed in 1.22.0Medium 6.5Oct 28vLLM: resource exhaustionvLLMCVE-2026-115913fixed in 0.32.0Medium 6.5Oct 28vLLM DeepSeek-OCR image processing vulnerable to denial of servicevLLMCVE-2026-115914fixed in 0.32.0Medium 6.5Oct 28vLLM: improper array index validationvLLMCVE-2026-115916fixed in 0.32.0Medium 6.5Oct 28vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsvLLMCVE-2026-115918fixed in 0.32.0Medium 6.5Oct 28vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolvLLMCVE-2026-115911fixed in 0.32.0Medium 4.3Oct 28LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsLangGraphCVE-2026-118667fixed in 1.2.14Medium 6.5Oct 28Secret masking bypass in the environment tool in Strands Agents ToolsAWSCVE-2026-115415no fix yetMedium 5.9Oct 28Unverified ownership of the default Athena query result location in AWS SDK for pandasAWSCVE-2026-118029no fix yetMedium 6.5Oct 27MLflow CrewAI autologging records LLM provider API keys in logged trace spansMLflowCVE-2026-116691fixed in 3.17.0Medium 6.8Oct 27MCP SDKs: improper authorizationMCP SDKsCVE-2026-116684fixed in 1.30.0 +1Medium 5.9Oct 27MCP SDKs: information disclosureMCP SDKsCVE-2026-116685fixed in 1.30.0 +1Medium 6.5Oct 27MCP SDKs: server-side request forgeryMCP SDKsCVE-2026-116686fixed in 1.30.0 +1Medium 6.8Oct 27LiteLLM vulnerable to reflected XSS in /sso/debug/callbackLiteLLMGHSA-hhww-mrg2-969hfixed in 1.85.0Medium 6.5Oct 27vllm p2p never connected zmq_exhaustionvLLMCVE-2026-94624fixed in 0.32.0Medium 6.5Oct 27Grafana: missing authorizationGrafanaCVE-2026-16491no fix yetMedium 5.5Oct 27Adobe Substance 3D Painter: out-of-bounds readAdobe Substance 3D PainterCVE-2026-48380no fix yetMedium 5.7Oct 27WatchGuard Technologies Fireware OS: improper authenticationFireware OSCVE-2026-82332fixed in 2026.4 +1Medium 6.1Oct 27WatchGuard Technologies Fireware OS: stack buffer overflowFireware OSCVE-2026-113881fixed in 2026.4 +1Medium 5.7Oct 27WatchGuard Technologies Mobile VPN with SSL Client: cleartext secretsMobile VPN with SSL ClientCVE-2026-115495fixed in 2026.4Medium 6.0Oct 27WatchGuard Technologies Fireware OS: missing authenticationFireware OSCVE-2026-104381fixed in 2026.4 +2Medium 4.9Oct 27Dell Technologies PowerProtect Data Domain: stack buffer overflowPowerProtect Data DomainCVE-2026-90725fixed in 8.9.0.0 or later +3Medium 6.0Oct 27Dell Technologies PowerProtect Data Domain: path traversalPowerProtect Data DomainCVE-2026-90726fixed in 8.9.0.0 or later +3Medium 6.5Oct 27Dell Technologies PowerProtect Data Domain: path traversalPowerProtect Data DomainCVE-2026-68866fixed in 8.9.0.0 or later +3Medium 5.7Oct 27Docker Desktop: secrets in logsDocker DesktopCVE-2026-114409fixed in 4.97.0Medium 5.8Oct 27Dell Technologies PowerProtect Data Domain: server-side request forgeryPowerProtect Data DomainCVE-2026-56084fixed in 8.9.0.0 or later +3Medium 6.3Oct 27Dell Technologies PowerProtect Data Domain: improper privilege managementPowerProtect Data DomainCVE-2026-90728fixed in 8.9.0.0 or later +3Medium 6.7Oct 27Dell Technologies PowerProtect Data Domain: improper privilege managementPowerProtect Data DomainCVE-2026-90729fixed in 8.9.0.0 or later +3Medium 6.5Oct 27Dell Technologies PowerProtect Data Domain: improper access controlPowerProtect Data DomainCVE-2026-90730fixed in 8.9.0.0 or later +3Medium 4.9Oct 27Dell Technologies PowerProtect Data Domain: stack buffer overflowPowerProtect Data DomainCVE-2026-90731fixed in 8.9.0.0 or later +3Medium 4.9Oct 27Dell Technologies PowerProtect Data Domain: stack buffer overflowPowerProtect Data DomainCVE-2026-90732fixed in 8.9.0.0 or later +3Medium 6.7Oct 27JetBrains Junie CLI: incomplete denylistJunie CLICVE-2026-117530fixed in 26.8.17Medium 6.6Oct 27Supermicro MBD-X12SPI: code executionMBD-X12SPICVE-2026-65213no fix yetMedium 4.9Oct 27Supermicro MBD-X12SPI: exposed filesMBD-X12SPICVE-2026-65210no fix yetMedium 4.3Oct 27Qt: out-of-bounds readQtCVE-2026-107472no fix yetMedium 5.3Oct 27qt: out-of-bounds readqtCVE-2026-105946fixed in 6.8.10 +1Medium 6.8Oct 27ASUS motherboards firmware: untrusted pointer dereferencemotherboards firmwareCVE-2026-88781no fix yetMedium 6.5Oct 26Apple Safari: improper input validationSafariCVE-2026-86985fixed in 27.2 +2Medium 5.5Oct 26Apple iOS and iPadOS: missing authorizationiOS and iPadOSCVE-2026-86987fixed in 27.2Medium 4.3Oct 26Apple iOS and iPadOS: memory corruptioniOS and iPadOSCVE-2026-86988fixed in 27.2 +2Medium 5.1Oct 26Apple iOS and iPadOS: improper authenticationiOS and iPadOSCVE-2026-86989fixed in 26.7.2 +1Medium 5.1Oct 26Apple iOS and iPadOS: improper access controliOS and iPadOSCVE-2026-86990fixed in 18.7.11 +2Medium 5.5Oct 26Apple macOS: improper access controlmacOSCVE-2026-86984fixed in 15.8.2 +2Medium 5.5Oct 26Apple iOS and iPadOS: out-of-bounds readiOS and iPadOSCVE-2026-86970fixed in 26.7.2 +2Medium 6.5Oct 26Apple iOS and iPadOS: out-of-bounds writeiOS and iPadOSCVE-2026-86971fixed in 26.7.2 +2Medium 6.5Oct 26Apple Safari: out-of-bounds readSafariCVE-2026-86973fixed in 27.2 +2Medium 5.5Oct 26Apple iOS and iPadOS: link followingiOS and iPadOSCVE-2026-86966fixed in 26.7.2 +2Medium 6.5Oct 26Apple iOS and iPadOS: out-of-bounds readiOS and iPadOSCVE-2026-86954fixed in 26.7.2 +2