JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

PYSEC-2026-4056 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

PYSEC-2026-4059 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

PYSEC-2026-4088 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

SummaryThe uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing files...

PYSEC-2026-4104 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

SummaryThe mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

ImpactRestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code.string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

PYSEC-2026-4161 RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

Allocation of Resources Without Limits or Throttling

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Directory Traversal

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Insertion of Sensitive Information into Log File

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses netty-handler-4.1.135.Final.jar, ion-java-1.11.1.jar, js-yaml-4.3.0.tgz, tar-7.5.20.tgz, python3.12 3.12.13-3.el98, github.com/go-jose/go-jose/v4 v4.1.3, github.com/apache/thrift v0.22.0, and google.golang.org/grpc 1.71.0 which are vulnerable to CVE-2026-62243,...

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

GHSA-8686-VHFX-7R3J vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

GHSA-3JQQ-PW4J-PQCJ JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.2.0 Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE 🔐 Apache Spark UI is susceptible to a remote command injection vulnerability identified as CVE-2022-33891. This flaw arises due to improper handling of user authentication and access control, specifically when Access Control Lists ACLs ar...