74120 matches found
CVE-2026-65908: Inclusion of Functionality from Untrusted Control Sphere
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...
OPENSUSE-SU-2026:11355-1 python313-pikepdf-10.5.1-2.1 on GA media
These are all security issues fixed in the python313-pikepdf-10.5.1-2.1 package on the GA media of openSUSE Tumbleweed...
Fedora 45 : libwignernj (2026-8d270f3d39)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8d270f3d39 advisory. Automatic update for libwignernj-0.7.0-6.fc45. Changelog Thu Jul 23 2026 Susi Lehtola - 0.7.0-6 - Fix gating on BR: libquadmath-devel. Thu Jul 23 2026 Susi...
amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.8), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73417 via jupyterlab (>=4.6.0a5, <=4.6.1)
jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73417 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233306...
cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73417 via jupyterlab (>=4.6.0, <=4.6.1)
jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73417 Source advisory: OSV:GHSA-PPPJ-HQ3G-57PJ...
elyra (>=2.0.0, <=3.0.0rc1), elyra-code-snippet-extension (>=2.2.0, <=3.0.0rc1) +11 more potentially affected by CVE-2026-73415 via jupyterlab (3.3.4)
jupyterlab PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra =2.0.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =0.1.1.10, =0.1.6.2, =0.0.1, =0.1.0, =0.0.13, =0.0.24 - retrolab 0.3.20 Source cves:...
elyra-code-snippet-extension (>=3.14.0, <=3.14.1), elyra-code-viewer-extension (>=3.14.0, <=3.14.1) +9 more potentially affected by CVE-2026-73415 via jupyterlab (3.5.3)
jupyterlab PYPI version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra-code-snippet-extension =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.0.7, =0.1.2, =0.0.1, =0.1.0, =0.0.2, =0.0.3 Source cve...
cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73415 via jupyterlab (>=4.6.0, <=4.6.1)
jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73415 Source advisory: GHSA-GX64-GJ6P-PC4C...
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...
amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.8), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73416 via jupyterlab (>=4.6.0a5, <=4.6.1)
jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73416 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233217...
GHSA-89VP-JRXV-24W8 JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...
amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.8), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73627 via jupyterlab (>=4.6.0a5, <=4.6.1)
jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73627 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233191...
cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73627 via jupyterlab (>=4.6.0, <=4.6.1)
jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73627 Source advisory: OSV:GHSA-H5V5-8746-G7MM...
elyra-code-snippet-extension (>=3.14.0, <=3.14.1), elyra-code-viewer-extension (>=3.14.0, <=3.14.1) +9 more potentially affected by CVE-2026-73626 via jupyterlab (3.5.3)
jupyterlab PYPI version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra-code-snippet-extension =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.0.7, =0.1.2, =0.0.1, =0.1.0, =0.0.2, =0.0.3 Source cve...
cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by unknown CVE via jupyterlab (>=4.6.0, <=4.6.1)
jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: unknown CVE Source advisory: GHSA-WHVH-WF3X-G77J...
amazon-sagemaker-sql-editor (>=0.1.1, <=0.2.8), cellmerge (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-73626 via jupyterlab (>=4.6.0a5, <=4.6.1)
jupyterlab PYPI version =4.6.0a5, =0.1.1, =0.1.0, =1.2.0, =7.5.0a0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 - xtralab 0.8.0 Source cves: CVE-2026-73626 Source advisory: SNYK:PYTHON-JUPYTERLAB-18233207...
cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73626 via jupyterlab (>=4.6.0, <=4.6.1)
jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
The extension allowlist/blocklist check inside PyPIExtensionManager.install was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install was intended to enforce the allowlist/blocklist itself for any future uses and users calling this...
ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +1724 more potentially affected by CVE-2026-10050 via org.eclipse.jetty:jetty-security (>=12.1.0, <=12.1.9)
org.eclipse.jetty:jetty-security MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =2.2.3, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.1 and more Source cves: CVE-2026-10050 Source advisory: OSV:GHSA-2FVJ-HGJ9-J2GR...
