airbyte-source-jira (>=3.4.0.dev202412051939, <=3.4.0.dev202412052135), airbyte-source-klaviyo (>=2.11.0.dev202411212104, <=2.11.3.dev202412021626) +1 more potentially affected by CVE-2026-50271 via ddtrace (2.16.4)

ddtrace PYPI version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - airbyte-source-jira =3.4.0.dev202412051939, =2.11.0.dev202411212104, =5.14.0.dev202506051219, =5.14.0.dev202506111019 Source cves: CVE-2026-50271...

open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented NAMESPACE/NAME syntax. The operator resolves the referenced resource cluster-wide and materializes its contents env...

GHSA-398H-7F66-3H4P open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented NAMESPACE/NAME syntax. The operator resolves the referenced resource cluster-wide and materializes its contents env...

CVE-2026-53447

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...

CVE-2026-52891

creationtimestamp| type| source ---|---|--- 2026-07-15 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5spsbr25 2026-07-16 00:30:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyal2izp2s 2026-07-18 04:18:04+00:00| seen|...

CVE-2026-40955

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:34+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptxriwj2v...

CVE-2026-40954

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:34+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptyijcs2m...

CVE-2026-40956

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:32+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptvxfo62x...

CVE-2026-40957

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:31+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptv4aip2e...

CVE-2026-62312

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpptu2t522m 2026-07-16 00:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpx4mn2pk2l...

CVE-2026-40958

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:30+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqppttx5vr2w...

CVE-2026-33443

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:27+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptrjhnh2e...

CVE-2026-33444

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:25+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptpescz2n...

CVE-2026-33445

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:24+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptodexj2v 2026-07-16 00:08:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwzgq2ev2u 2026-07-17 09:37:07+00:00| seen|...

CVE-2026-55399

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:20+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptkgjxg2x...

Duplicate Advisory: Command Injection in jsii-diff via npm: package argument

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wcx4-wpfv-mc5c. This link is maintained to preserve external references. Original Description OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-depende...

GHSA-H738-VH6G-Q8GH Duplicate Advisory: Command Injection in jsii-diff via npm: package argument

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wcx4-wpfv-mc5c. This link is maintained to preserve external references. Original Description OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-depende...

CVE-2026-49988

creationtimestamp| type| source ---|---|--- 2026-07-15 21:30:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpo5tfq562s...

JLSEC-2026-770 OSGeo GDAL vulnerable to out-of-bounds read

A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the...

CVE-2026-62947

creationtimestamp| type| source ---|---|--- 2026-07-15 21:25:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpnuuez3f2s 2026-07-19 00:01:59+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqxhztoy432e...