This archive includes all published incident pages. Page 38 of 41.
Each page is intended to help a security team answer three questions quickly: why the issue is AI-relevant, what part of the workflow may be exposed, and what actions should happen first.
Selection criteria and correction policy are documented in Methodology & Editorial Policy.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Unauthenticated Admission Webhook Endpoints in Yoke ATC This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
A vulnerability in CediPay allows attackers to bypass input validation in the transaction API. Affected users: All deployments running versions prior to the patched release.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing attackers to cause denial-of-service via memory exhaustion.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Impact It's possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Summary FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Summary An attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Summary An attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message.
Source disclosure: February 12, 2026 | Published on Radar: February 25, 2026
Notepad++ Notepad++ - Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an...
Source disclosure: February 10, 2026 | Published on Radar: February 25, 2026
Overview A prototype pollution vulnerability present in CASL Ability versions 2.4.0 through 6.7.4 is triggered through the rulesToFields() function in the extra module.
Source disclosure: February 5, 2026 | Published on Radar: February 14, 2026
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.32, there is a DoS vulnerability in ReadRSSFeedBlock.