PYSEC-2026-1468 OpenStack Ironic fails to verify checksums of supplied image_source URLs

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied imagesource URLs when configured to convert images to a raw format for streaming...

PYSEC-2026-1108 In aiohttp, compressed files as symlinks are not protected from path traversal

Summary Static routes which contain files with compressed variants .gz or .br extension were vulnerable to path traversal outside the root directory if those variants are symbolic links. Details The server protects static routes from path traversal outside the root directory when...

PYSEC-2026-1918 setuptools vulnerable to Command Injection via package URL

A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code...

CVE-2026-53481

creationtimestamp| type| source ---|---|--- 2026-07-07 13:14:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2op7m3ox2g 2026-07-07 13:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116878935892069928 2026-07-07 13:30:31+00:00| seen|...

PYSEC-2026-1509 langchain Server-Side Request Forgery vulnerability

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

CVE-2025-63079

creationtimestamp| type| source ---|---|--- 2026-07-07 11:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2i47t6uk2r 2026-07-07 11:16:08+00:00| seen| https://bsky.app/profile/potato.software/post/3mq2i4bpfxr24...

CVE-2026-34037

creationtimestamp| type| source ---|---|--- 2026-07-07 04:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpzpxpr5wr2h 2026-07-07 04:21:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzqxmsj2d2u 2026-07-07 04:30:26+00:00| seen|...

PT-2026-56245

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description A share mode chart data interface fails to validate whether the tableId and field IDs provided in the request body belong to the shared resource. It only verifies that the sceneId matches the...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the coder open app process. An attacker can obtain a user's session token and impersonate their account by crafting a malicious external app URL containing a session token placeholder, which is then replaced with the...

GHSA-X76W-8C62-48MG Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Summary A user with Control Panel access but without permission to view a target private asset can call assets/preview-thumb and receive preview HTML that contains a signed fallback transform link for that private asset. Details Root-cause analysis: 1. The endpoint accepts an attacker-controlled...

NPM: Decompress: Archive extraction can create files and links outside of the target directory

NPM: Decompress: Archive extraction can create files and links outside of the target directory vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

EUVD-2026-24963

chmod: --preserve-root bypassed by any path that resolves to root e.g. /../...

CVE-2026-54269

creationtimestamp| type| source ---|---|--- 2026-07-06 07:58:49+00:00| seen| https://gist.github.com/alon710/85679449cb8fbdc65386d384f1841a0e 2026-07-06 07:59:30+00:00| seen| https://gist.github.com/alon710/e1c58c0e5e300cd65a71e5b861eaf325...

GHSA-F38Q-MGVJ-VPH7

creationtimestamp| type| source ---|---|--- 2026-07-06 07:58:49+00:00| seen| https://gist.github.com/alon710/85679449cb8fbdc65386d384f1841a0e 2026-07-06 07:59:30+00:00| seen| https://gist.github.com/alon710/e1c58c0e5e300cd65a71e5b861eaf325...

ROS-20260706-73-0027

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

CVE-2019-10954

creationtimestamp| type| source ---|---|--- 2026-07-05 23:58:39+00:00| seen| https://gist.github.com/HansBug/7d0884ae378f2f85ea1bb0aa04abe56d 2026-07-06 00:00:05+00:00| seen| https://gist.github.com/HansBug/7d0884ae378f2f85ea1bb0aa04abe56d 2026-07-06 00:06:10+00:00| seen|...

CVE-2026-57322

creationtimestamp| type| source ---|---|--- 2026-07-05 10:16:32+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpvdtuhers2u 2026-07-05 10:16:33+00:00| seen| https://bsky.app/profile/potato.software/post/3mpvdtvadpc2b...

GHSA-4PQ2-JH73-G3HW

creationtimestamp| type| source ---|---|--- 2026-07-05 00:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116864426613570439 2026-07-05 00:00:36+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpubgil3hs2b...

CVE-2026-5137

creationtimestamp| type| source ---|---|--- 2026-07-03 23:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mprohzoe242j 2026-07-03 23:46:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mprq5zrrvf2f 2026-07-03 23:46:22+00:00| seen|...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the process handling Composer package source links. An attacker can gain unauthorized access to private or internal package source information by directly accessing these links...