yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

ImpactThe Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases.To pass extra control data between...

PYSEC-2026-1508 Langchain Server-Side Request Forgery vulnerability

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

PYSEC-2026-1969 TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

Summary The torbot.modules.validators.validatelink function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument.. Details...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2023-35934 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2023-35934 Source advisory: OSV:PYSEC-2026-2067...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2023-35934 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2023-35934 Source advisory: OSV:PYSEC-2026-2067...

PYSEC-2026-1149 Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

agogosml-cli (0.1.2), chip-wallet-dstack (>=1.3.0, <=1.5.0) +23 more potentially affected by CVE-2023-32758 via git-url-parse (>=1.0.2, <=1.2.2)

git-url-parse PYPI version =1.0.2, =1.3.0, =1.11.4rc1, =0.3.1.1, =0.5.0, =0.0.4rc12, =0.1.2, =0.1.0, =0.0.1, =0.25.0, =0.3.10, =0.6.8 and more Source cves: CVE-2023-32758 Source advisory: OSV:PYSEC-2026-1404...

CVE-2026-48828

creationtimestamp| type| source ---|---|--- 2026-07-07 11:34:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2j5dmjes2x 2026-07-07 12:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2li2o6vg2w...

CVE-2026-14476

creationtimestamp| type| source ---|---|--- 2026-07-07 11:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2iytgfgd2a 2026-07-20 13:12:20+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mr3enz3dlw2l 2026-07-20 14:14:46+00:00| seen|...

Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

PYSEC-2026-1064 Open redirect in web2py

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack...

PYSEC-2026-803 Cross-site Scripting in django-ajax-utilities

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file djangoajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site...

PYSEC-2026-809 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2026-57868

creationtimestamp| type| source ---|---|--- 2026-07-07 08:39:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq27ddn7ny2u...

CVE-2026-8309

creationtimestamp| type| source ---|---|--- 2026-07-07 08:24:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq26ii7rnj2b...

CVE-2026-57871

creationtimestamp| type| source ---|---|--- 2026-07-07 08:02:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq25c7qnkf2a...

CVE-2026-5730

creationtimestamp| type| source ---|---|--- 2026-07-07 07:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq254tqfsn2a...

CVE-2026-34198

creationtimestamp| type| source ---|---|--- 2026-07-07 04:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzr7cexwq2y...

CVE-2026-34171

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/uuid endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit...