PYSEC-2026-2562 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

Server-Side Request Forgery SSRF in ChatOpenAI Image Token Counting Summary The ChatOpenAI.getnumtokensfrommessages method fetches arbitrary imageurl values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery SSRF...

Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

SummaryA Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...

PYSEC-2026-2976 Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...

PYSEC-2026-2980 Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...

PYSEC-2026-3413 web2py has an Open Redirect Vulnerability

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing atta...

SUSE-SU-2026:22643-1 Security update for go1.25

This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta content...

Malicious code in router-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625 [email protected] exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants protocol, separato...

PYSEC-2026-2453 Docassemble unauthorized access through URL manipulation

Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...

Docassemble unauthorized access through URL manipulation

ImpactThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. PatchesThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...

MAL-2026-10444 Malicious code in markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...

OPENSUSE-SU-2026:21319-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session...

Improper Handling of URL Encoding (Hex Encoding)

Overview Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding in the MCP REST client due to improper encoding of user-supplied identifiers during f-string URL construction. An attacker can access unintended API endpoints by injecting crafted path...

CVE-2026-57805

creationtimestamp| type| source ---|---|--- 2026-07-13 12:34:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjpbecik52e...

CVE-2026-61955

creationtimestamp| type| source ---|---|--- 2026-07-13 11:59:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjndygvcm2y 2026-07-13 18:04:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbqk2co427 2026-07-14 02:02:07+00:00| seen|...

CVE-2026-61956

creationtimestamp| type| source ---|---|--- 2026-07-13 11:56:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn5hwcrf2f 2026-07-13 19:45:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhf5qieu2c 2026-07-14 02:20:58+00:00| seen|...

CVE-2026-59521

creationtimestamp| type| source ---|---|--- 2026-07-13 11:55:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn4eonhm2z 2026-07-13 19:45:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhecakde22 2026-07-14 02:20:17+00:00| seen|...

CVE-2026-59516

creationtimestamp| type| source ---|---|--- 2026-07-13 11:54:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn2rtdon22 2026-07-13 19:04:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkf3xenwt2z 2026-07-14 02:05:01+00:00| seen|...

CVE-2026-57734

creationtimestamp| type| source ---|---|--- 2026-07-13 11:21:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjla432an2y...

CVE-2026-57733

creationtimestamp| type| source ---|---|--- 2026-07-13 11:21:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl6z33xh27 2026-07-13 21:33:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqknexzdpt27 2026-07-16 07:57:09+00:00| seen|...

CVE-2026-57728

creationtimestamp| type| source ---|---|--- 2026-07-13 11:19:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl3decem2e 2026-07-16 07:56:52+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr6ay6ty2b...