GHSA-QCQ2-496W-V96P vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook...

CVE-2026-52979

creationtimestamp| type| source ---|---|--- 2026-07-11 01:28:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdj4qollq2y...

CVE-2026-15293

creationtimestamp| type| source ---|---|--- 2026-07-11 00:52:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdh52eu3v2y 2026-07-12 19:01:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhuh7g3ez2l...

CVE-2026-59217

creationtimestamp| type| source ---|---|--- 2026-07-11 00:34:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4fw5q22i...

EUVD-2026-43069

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting XSS. This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1...

CVE-2026-56668

creationtimestamp| type| source ---|---|--- 2026-07-11 00:25:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfm6nrb62e 2026-07-11 18:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfalk4a2i2w...

PT-2026-57486

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Deserialization of untrusted data allows an unauthorized attacker to execute code over a network. Deserialization is the process of converting a data format, such as JSO...

CVE-2026-59868

creationtimestamp| type| source ---|---|--- 2026-07-10 23:59:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqde5mvdyk2d 2026-07-20 22:37:26+00:00| published-proof-of-concept| https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv...

CVE-2026-54159

creationtimestamp| type| source ---|---|--- 2026-07-10 23:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqdbtxqsty2r 2026-07-18 00:45:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquzxtp3m724 2026-07-18 05:01:52+00:00| seen|...

CVE-2026-55782

creationtimestamp| type| source ---|---|--- 2026-07-10 23:11:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbhkys5q2y 2026-07-10 23:43:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddc2bxvo27...

CVE-2026-3251

creationtimestamp| type| source ---|---|--- 2026-07-10 22:56:00+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqdamij56426 2026-07-10 22:56:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdamjacrt2a 2026-07-11 00:13:37+00:00| seen|...

CVE-2026-55804

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...

CVE-2026-55807

Server-Side Request Forgery SSRF vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1...

CVE-2026-13237

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1...

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

CVE-2026-15080 Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

Cross-Site Request Forgery CSRF vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4...

CVE-2026-55809 Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-57807

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO OAuth Client allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO OAuth Client: from n/a through 38.5.8...

DEBIAN-CVE-2026-57218

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

CVE-2026-57213

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...