CVE-2026-55635

DataEase contains an authenticated SQL injection in chart quota filters prior to version 2.10.24. The vulnerability arises when quota and Y-axis filters embed attacker-controlled values directly into generated SQL within Quota2SQLObj.getYWheres(), without applying the SQL literal validation and e...

CVE-2026-55635 DataEase: Authenticated SQL Injection in Chart Quota Filters

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres without applying the SQL literal validation and escaping used by other filter paths,...

Moderate: Red Hat Security Advisory: aardvark-dns security update

An update for aardvark-dns is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset

A flaw was found in aardvark-dns where a specially crafted TCP DNS query followed by a connection reset can trigger an infinite error loop, leading to 100% CPU usage and a denial of service. As aardvark-dns is only accessible via internal Podman networks, this issue can be exploited by a local...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2026-1703 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2026-1703 Source advisory: OSV:PYSEC-2026-1796...

unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic

A flaw was found in Unbound. An adversary who can query a vulnerable Unbound instance and control a slow or malicious domain name server can exploit a vulnerability in the jostle logic. This flaw allows retransmitted queries to renew the age of slow-running queries, preventing them from being...

GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter reflected DOM XSS...

PYSEC-2026-1402 GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter reflected DOM XSS...

PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...

Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting LibraryComponent: parsl.monitoring.visualizationVulnerability Type: SQL Injection CWE-89Severity: High CVSS Rating Recommended: 7.5 - 8.6URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.pySummaryA SQL Injection...

amundsen-metadata (>=2.5.5, <=3.5.0), bspider (>=0.0.5a0, <=0.0.8) +13 more potentially affected by CVE-2025-66221 via werkzeug (0.15.5)

werkzeug PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =2.5.5, =0.0.5a0, =1.3.1, =1.2.3, =0.1.3, =0.0.1, =0.0.9, =0.50.0, =1.0.6, =0.1.0, =4.2.0, =0.10.21, =0.15.37 Source cves:...

LangGraph's SQLite store implementation has a SQL Injection Vulnerability

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators $eq, $ne, $gt, $lt, $gte, $lt...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62801 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62800 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62800 Source advisory: OSV:PYSEC-2026-1364...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2025-8869 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...

PYSEC-2026-1088 Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

SummaryLanceDocChatAgent uses pandas eval through computefromdocs:https://github.com/langroid/langroid/blob/18667ec7e971efc242505196f6518eb19a0abc1c/langroid/vectorstore/base.pyL136-L150As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc...

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query...

PYSEC-2026-2048 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query...