PT-2026-33800

🗓️ 20 Apr 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 13 Views

Python-dotenv before 1.2.2 can be hijacked via symlinks to overwrite files when rewriting the .env, upgrade or patch.

Reporter	Title	Published	Views	Family All 182
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	30 Jun 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.	28 Jul 202615:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in pyjwt-2.12.1-py3-none-any.whl	17 Jun 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv [CVE-2026-28684]	27 Jul 202618:40	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	23 Jul 202613:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of integrity, arbitrary code execution, denial of service and SSRF	6 May 202613:03	–	ibm
IBM Security Bulletins	Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument	4 Aug 202609:56	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	30 Jun 202607:44	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CLEANSTART-2026-FT24360
osv	www.osv.dev/vulnerability/openSUSE-SU-2026:20952-1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45409
osv	www.osv.dev/vulnerability/CVE-2026-44307
osv	www.osv.dev/vulnerability/ghsa-v92g-xgxw-vvmm
osv	www.osv.dev/vulnerability/OESA-2026-2198
osv	www.osv.dev/vulnerability/SUSE-SU-2026:22118-1
osv	www.osv.dev/vulnerability/CVE-2026-44431
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-28684
osv	www.osv.dev/vulnerability/CVE-2026-45409

01 Jul 2026 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 3.16.6

EPSS0.0037

SSVC