apputils-config (>=2.0.2.dev19, <=2.0.2.dev20), aws-gate (>=0.9.3, <=0.11.0) +43 more potentially affected by CVE-2026-69248 via cryptography (3.3.1)

cryptography PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.2.dev19, =0.9.3, =0.1.1, =1.1.0, =1.2.3, =3.26.0, =0.1.1, =21.1.0, =0.1.0, =0.0.1, =0.2.0, =0.2.8 and more Source...

apputils-config (>=2.0.0, <=2.0.1.dev13), burstable (>=0.2.5rc2, <=0.2.6) +32 more potentially affected by CVE-2026-69249 via cryptography (3.0.0)

cryptography PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.0, =0.2.5rc2, =0.13.0, =3.16.0.dev2, =0.8.0, =0.0.1, =0.0.2, =11.0.0b3, =0.1.2, =1.0.0, =0.1.9, =0.1.12 and more...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

SummaryThe ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

CVE-2026-11366 MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...

PT-2026-67779

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An incomplete environment variable validation in the validateEnvironmentVariables function within packages/components/nodes/tools/MCP/core.ts allows a bypass of security controls intended to prevent...

CVE-2026-47763: UNIX Symbolic Link (Symlink) Following

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

PT-2026-67864

Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A remote command injection issue exists in the /api/esps endpoint. The flaw is located within the reload.reload config function, allowing a remote attacker to execute arbitrary commands on the system...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

PT-2026-74236

TuxCare rebuilt parse-git-config to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

SUSE CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...