amundsen-frontend (>=1.0.1, <=2.3.0), amundsen-metadata (>=1.0.17, <=3.5.0) +10 more potentially affected by CVE-2025-71176 via pytest (3.5.1)

pytest PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - amundsen-frontend =1.0.1, =1.0.17, =2.4.1, =0.1.4, =0.1.3, =1.2.0, =1.10.0, =0.2.7, =1.2.0, =0.1.0, =0.1.2 Source cves: CVE-2025-71176 Source...

Moonraker affected by LDAP search filter injection

ImpactInstances of Moonraker configured with the ldap component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LD...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-22691 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-22691 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-22690 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-22690 Source...

PYSEC-2026-1691 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

Summary On Windows, converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a inkscape.bat file that defines a Windows batch script, capable of arbitrary code execution. When a user runs jupyter nbconvert --to pdf on a...

nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

SummaryOn Windows, converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a inkscape.bat file that defines a Windows batch script, capable of arbitrary code execution.When a user runs jupyter nbconvert --to pdf on a...

amundsen-metadata (>=1.0.18, <=2.5.4), amundsen-search (>=2.4.1, <=2.5.1) +8 more potentially affected by CVE-2025-66221 via werkzeug (0.15.3)

werkzeug PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =1.0.18, =2.4.1, =0.0.1, =0.0.6, =0.9.94, =0.0.1, =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2025-66221 Source advisory:...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-66019 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-66019 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-62708 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-62708 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-62707 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-62707 Source...

cde (0.2.0.1), env-wrappers (>=0.1.1, <=0.1.22) +1 more potentially affected by CVE-2025-10951 via ml-logger (0.10.36)

ml-logger PYPI version 0.10.36 is affected by a known vulnerability. The following packages have a transitive dependency on ml-logger and may be impacted: - cde 0.2.0.1 - env-wrappers =0.1.1, =0.1.22 - graph-search 0.1.0 Source cves: CVE-2025-10951 Source advisory: OSV:PYSEC-2026-1634...

cde (0.2.0.1), env-wrappers (>=0.1.1, <=0.1.22) +1 more potentially affected by CVE-2025-10952 via ml-logger (0.10.36)

ml-logger PYPI version 0.10.36 is affected by a known vulnerability. The following packages have a transitive dependency on ml-logger and may be impacted: - cde 0.2.0.1 - env-wrappers =0.1.1, =0.1.22 - graph-search 0.1.0 Source cves: CVE-2025-10952 Source advisory: OSV:PYSEC-2026-1635...

PYSEC-2026-1968 TkEasyGUI Affected by Uncontrolled Search Path Element Issue

Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program...

TkEasyGUI Affected by Uncontrolled Search Path Element Issue

Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-55197 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-55197 Source...

PYSEC-2026-1462 Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

Indico vulnerability allows attackers to bulk dump user details

ImpactAn endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

aerospike-vector-search (>=1.0.0, <=4.2.0), aidbbot (>=0.1.0, <=0.1.2) +383 more potentially affected by CVE-2025-4565 via protobuf (>=5.26.0rc2, <=5.29.4)

protobuf PYPI version =5.26.0rc2, =1.0.0, =0.1.0, =0.82.3, =2.47.9, =0.1.8, =0.0.10, =0.4.1, =1.0.3, =1.0.0, =0.5.0rc2, =0.7.3, =0.9.0, =0.1.16, =1.1.0, =0.3.5, =0.4.1 and more Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

ImpactOn Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users.Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

PYSEC-2026-1477 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Impact On Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...