EUVD-2026-42091

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute...

CVE-2026-53730

CVE-2026-53730 — DataEase : Affected product is DataEase (open source data visualization/analysis tool). Before version 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation, allowing any authenticated user to specify datasourceId=-1, access the ...

CVE-2026-53730 DataEase: Unauthorized Access to Engine Database via previewSql Endpoint

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute...

CVE-2026-53730 DataEase: Unauthorized Access to Engine Database via previewSql Endpoint

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute...

MariaDB: DATA / INDEX DIRECTORY Abuse

A vulnerability was identified in the DATA DIRECTORY and INDEX DIRECTORY functionality of a database system. Users with ordinary schema-level privileges were able to write arbitrary data to attacker-chosen locations by exploiting path traversal issues in how external table directories were...

rarecrowds (>=0.0.1, <=0.0.5), sage-engine (2.3.0) +1 more potentially affected by CVE-2026-0994 via protobuf (3.15.7)

protobuf PYPI version 3.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - rarecrowds =0.0.1, =0.0.5 - sage-engine 2.3.0 - training-grounds 0.0.2 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

bigquery-fdw (>=2.1.1, <=2.1.2), bxsolana-trader (1.7.0) +6 more potentially affected by CVE-2026-0994 via protobuf (4.21.8)

protobuf PYPI version 4.21.8 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bigquery-fdw =2.1.1, =0.0.13, =0.2.0, =0.0.2, =0.4.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

autodist (>=0.7.0rc1, <=0.7.0rc2), sage-engine (>=2.1.0, <=2.2.0) potentially affected by CVE-2026-0994 via protobuf (3.11.0)

protobuf PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - autodist =0.7.0rc1, =2.1.0, =2.2.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-24688 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-24688 Source advisory: OSV:PYSEC-2026-1827...

easyvvuq (>=0.5.2.1, <=0.5.2.2), feature-engine (0.3.0) +11 more potentially affected by CVE-2025-71176 via pytest (4.3.1)

pytest PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - easyvvuq =0.5.2.1, =0.0.3, =0.1.3, =0.10.7, =2019.3.12, =0.0.11, =0.1.2, =0.1.0.dev2210, =0.1.1 Source cves: CVE-2025-71176 Source advisory:...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-22690 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-22690 Source advisory: OSV:PYSEC-2026-1829...

bokcolmaps (0.3.1), bokodapviewer (0.1.3) +2 more potentially affected by CVE-2026-21883 via bokeh (0.12.6)

bokeh PYPI version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - bokcolmaps 0.3.1 - bokodapviewer 0.1.3 - pandexo-engine =1.5.1, =0.1.0, =0.1.2 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1223...

elemeno-ai-sdk (>=0.0.5, <=0.6.11), elemeno-mlops-cli (>=0.0.1, <=0.0.4) +22 more potentially affected by CVE-2025-11157 via feast (>=0.9.3, <=0.49.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.3.0, =0.1.0rc3, =0.0.2, =1.0.0, =0.1.0, =0.1.33.dev3, =0.1.0, =0.6.19 and more Source cves: CVE-2025-11157 Source advisory: OSV:PYSEC-2026-1366...

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

SummaryUsers can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape e.g. hidden dimension is wrong, regardless of whether the model is intended to support such inputs as defined in the Supported Models page.The issue has...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-66019 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-66019 Source advisory: OSV:PYSEC-2026-1832...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-62708 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-62708 Source advisory: OSV:PYSEC-2026-1831...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-62707 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-62707 Source advisory: OSV:PYSEC-2026-1833...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6051 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6051 Source advisory: OSV:PYSEC-2026-1988...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6921 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6921 Source advisory: OSV:PYSEC-2026-1980...

cdisc-rules-engine (>=0.1.0, <=0.4.7.8), systembridgebackend (>=3.4.0.dev2, <=3.4.3) +2 more potentially affected by CVE-2025-59042 via pyinstaller (5.2.0)

pyinstaller PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - cdisc-rules-engine =0.1.0, =3.4.0.dev2, =3.4.0.dev2, =3.4.0.dev2, =3.4.3 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...