meltano (>=2.16.0, <=3.6.0b4), nmdc-schema (>=0.0.0, <=7.4.12) +2 more potentially affected by CVE-2024-53848 via check-jsonschema (>=0.19.2, <=0.29.4)

check-jsonschema PYPI version =0.19.2, =2.16.0, =0.0.0, =0.3.0, =0.3.0, =0.4.1 Source cves: CVE-2024-53848 Source advisory: OSV:PYSEC-2026-1245...

Malicious code in @applicationbuildingcenter/xcube-schema (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7037 Malicious code in @applicationbuildingcenter/xcube-schema (npm)

--- -= Per source details. Do not edit below this line.=-...

dbt (0.18.1), dbt-bigquery (0.18.1) +7 more potentially affected by CVE-2024-36105 via dbt-core (0.18.1)

dbt-core PYPI version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.1 - dbt-bigquery 0.18.1 - dbt-duckdb 0.18.1 - dbt-mysql 0.18.1.1 - dbt-postgres 0.18.1 - dbt-presto 0.18.1 - dbt-redshift 0.18.1 -...

dbt (0.16.0), dbt-bigquery (0.16.0) +7 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0)

dbt-core PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0 - dbt-bigquery 0.16.0 - dbt-oracle =0.1.3, =0.1.0, =0.2.0 - dbt-snowflake 0.16.0 - dbt-spark 0.16.0 Source cves: CVE-2024-36105 Sour...

PYSEC-2026-1140 Apache Airflow Spark Provider vulnerable to improper input validation

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field...

Apache Airflow Spark Provider vulnerable to improper input validation

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field...

PT-2026-67311

Name of the Vulnerable Software and Affected Versions better-auth SCIM versions 1.5.0 through 1.7.0-beta.3 Description By default, the @better-auth/scim plugin fails to bind non-organization personal SCIM providers to their creator. This occurs because the providerOwnership option and the...

GHSA-6XC5-4R68-67FC Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

SQLChatAgent validatequery dangerous-pattern regex is bypassable via quoted/commented/qualified function names Summary The SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only...

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

SQLChatAgent validatequery dangerous-pattern regex is bypassable via quoted/commented/qualified function names Summary The SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only...

PYSEC-2026-912 Denial of Service in python-ldap

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...

Denial of Service in python-ldap

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...

PT-2026-56062

Name of the Vulnerable Software and Affected Versions Langroid versions prior to 0.65.1 Description Langroid is a framework for building large-language-model-powered applications. The SQLChatAgent component implements a SQL-injection mitigation that uses a raw-text regex blocklist DANGEROUS SQL...

MiracleLinux 9 : mariadb:11.8 galera-26.4.25-1.module+el9+1156+5d43ddb4, mariadb-11.8.6-2.module+el9+1156+5d43ddb4 (AXSA:2026-1196:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1196:01 advisory. MariaDB: MariaDB: Remote Code Execution or Denial of Service via JSONSCHEMAVALID function vulnerability CVE-2026-32710 Tenable has extracted the preceding...

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

CVE-2026-27436

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

CVE-2026-27436 WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

EUVD-2026-41338

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

CVE-2026-27436 WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

CVE-2026-27436

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...