homeassistant-stubs (2022.5.5), mqtt-hass-base (3.0.3) +1 more potentially affected by CVE-2023-50715 via homeassistant (2022.5.5)

homeassistant PYPI version 2022.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.5.5 - mqtt-hass-base 3.0.3 - pytest-homeassistant-custom-component 0.9.3 Source cves: CVE-2023-50715 Sourc...

homeassistant-stubs (>=2023.1.0b0, <=2023.12.2), hydroqc2mqtt (>=0.9.0, <=0.12.4) +2 more potentially affected by CVE-2023-50715 via homeassistant (>=2023.1.0b0, <=2023.12.2)

homeassistant PYPI version =2023.1.0b0, =2023.1.0b0, =0.9.0, =4.1.4, =0.12.37, =0.13.84 Source cves: CVE-2023-50715 Source advisory: OSV:PYSEC-2026-1451...

homeassistant-stubs (2022.10.2), mqtt-hass-base (4.0.14) +1 more potentially affected by CVE-2023-50715 via homeassistant (2022.10.2)

homeassistant PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.2 - mqtt-hass-base 4.0.14 - pytest-homeassistant-custom-component 0.12.7 Source cves: CVE-2023-50715...

Any file can be included with the pymdown-snippets extension

SummaryArbitrary file read when using include file syntax. DetailsBy using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to...

PYSEC-2026-1824 Any file can be included with the pymdown-snippets extension

Summary Arbitrary file read when using include file syntax. Details By using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to...

adze-modeler (0.0.1), arctic-ai (0.1.0) +59 more potentially affected by CVE-2023-32309 via pymdown-extensions (>=4.11.0, <=9.11.0)

pymdown-extensions PYPI version =4.11.0, =0.3.1b1, =0.2.0, =1.1.3, =0.1.0, =0.1.0, =0.1.0, =0.9.1, =0.9.0, =0.9.0, =0.3.3, =0.3.4.1 and more Source cves: CVE-2023-32309 Source advisory: OSV:PYSEC-2026-1824...

PYSEC-0000-CVE-2026-33264

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

PYSEC-2026-2082

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

PYSEC-2026-2082

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

DEBIAN-CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

AZL-92069 CVE-2026-11610 affecting package 389-ds-base 3.1.1-12

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

EUVD-2026-42030

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

A bug in BaseSerialization.deserialize allowed unrestricted importstring of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossin...

CVE-2026-11610

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...