homeassistant-stubs (2022.9.7), mqtt-hass-base (>=4.0.11, <=4.0.13) +1 more potentially affected by CVE-2025-65713 via homeassistant (2022.9.7)

homeassistant PYPI version 2022.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.7 - mqtt-hass-base =4.0.11, =4.0.13 - pytest-homeassistant-custom-component 0.11.26 Source cves:...

arkindex-base-worker (>=0.3.2rc1, <=0.3.2rc3), rooster-client (0.0.1) potentially affected by CVE-2025-68142 via pymdown-extensions (9.9.0)

pymdown-extensions PYPI version 9.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.2rc1, =0.3.2rc3 - rooster-client 0.0.1 Source cves: CVE-2025-68142 Source advisory:...

arkindex-base-worker (>=0.3.1rc5, <=0.3.1) potentially affected by CVE-2025-68142 via pymdown-extensions (9.7.0)

pymdown-extensions PYPI version 9.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1rc5, =0.3.1 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

arkindex-base-worker (>=0.3.1rc3, <=0.3.1rc4) potentially affected by CVE-2025-68142 via pymdown-extensions (9.6.0)

pymdown-extensions PYPI version 9.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1rc3, =0.3.1rc4 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

arkindex-base-worker (>=0.3.1b1, <=0.3.1rc2), labext-pkg (2.2.0) +3 more potentially affected by CVE-2025-68142 via pymdown-extensions (9.5.0)

pymdown-extensions PYPI version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.1b1, =0.0.4, =0.0.130, =2023.11.4 - stuffpages 0.7.4 Source cves: CVE-2025-68142 Source advisory:...

arctic-ai (0.1.0), arkindex-base-worker (>=0.3.2rc5, <=0.3.2) potentially affected by CVE-2025-68142 via pymdown-extensions (9.9.2)

pymdown-extensions PYPI version 9.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arctic-ai 0.1.0 - arkindex-base-worker =0.3.2rc5, =0.3.2 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

anitya (1.8.1), datarobot-drum (>=1.10.0.dev2, <=1.10.11) +5 more potentially affected by CVE-2025-66221 via werkzeug (2.3.4)

werkzeug PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - anitya 1.8.1 - datarobot-drum =1.10.0.dev2, =0.0.13, =3.2.4, =3.9.0rc4, =4.1.3 Source cves: CVE-2025-66221 Source advisory: OSV:PYSEC-2026-2046...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2025-66221 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2025-66221 Source advisory:...

baicai-base (0.1.2), baicai-tutor (0.1.0) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.25)

langgraph-checkpoint PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 Source cves: CVE-2025-64439 Source advisory: OSV:PYSEC-2026-1527...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +38 more potentially affected by CVE-2025-62708 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

apollo-sdk (>=0.2.4, <=0.2.11), decore-base (>=0.0.13, <=0.0.24) +1 more potentially affected by CVE-2025-59042 via pyinstaller (5.11.0)

pyinstaller PYPI version 5.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - apollo-sdk =0.2.4, =0.0.13, =0.2.11, =0.2.12 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

ImpactA denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image...

femtocrux (0.2.2), meteva (>=1.7.3, <=1.8.0.1) +3 more potentially affected by CVE-2025-4565 via protobuf (3.20.0rc2)

protobuf PYPI version 3.20.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - femtocrux 0.2.2 - meteva =1.7.3, =0.1.0, =0.0.2, =0.5.2, =1.0.0a8 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

Langchain-Chatchat has a Path Traversal vulnerability

A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function uploadtempdocs of the file /knowledgebase/uploadtempdocs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to...

PYSEC-2026-1513 Langchain-Chatchat has a Path Traversal vulnerability

A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function uploadtempdocs of the file /knowledgebase/uploadtempdocs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to...

CVE-2026-14969 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

AZL-92189 CVE-2026-14940 affecting package 389-ds-base 3.1.1-12

A heap-buffer-overflow flaw was found in 389 Directory Server 389-ds-base. When normalizing a Distinguished Name DN that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name RDN, the server can write past the end of a heap allocation while sorting RDN...

DEBIAN-CVE-2026-14940

A heap-buffer-overflow flaw was found in 389 Directory Server 389-ds-base. When normalizing a Distinguished Name DN that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name RDN, the server can write past the end of a heap allocation while sorting RDN...

CVE-2026-14940

A heap-buffer-overflow flaw was found in 389 Directory Server 389-ds-base. When normalizing a Distinguished Name DN that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name RDN, the server can write past the end of a heap allocation while sorting RDN...

UBUNTU-CVE-2026-14940

A heap-buffer-overflow flaw was found in 389 Directory Server 389-ds-base. When normalizing a Distinguished Name DN that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name RDN, the server can write past the end of a heap allocation while sorting RDN...