39420 matches found
PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py
A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function issafeast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-35052 via dtale (2.2.0)
dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2026-35052 Source advisory: OSV:PYSEC-2026-2460...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-35052 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2026-35052 Source advisory: OSV:PYSEC-2026-2460...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-33699 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-33699 Source advisory: OSV:PYSEC-2026-3012...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-31826 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-31826 Source advisory: OSV:PYSEC-2026-3019...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-28804 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-28804 Source advisory: OSV:PYSEC-2026-3014...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-28351 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-28351 Source advisory: OSV:PYSEC-2026-3017...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-27888 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-27888 Source advisory: OSV:PYSEC-2026-3027...
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-27628 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-27628 Source advisory: OSV:PYSEC-2026-3005...
PYSEC-2026-2373 Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...
intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27194 via dtale (2.2.0)
dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2026-27194 Source advisory: OSV:PYSEC-2026-2461...
trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-27194 via dtale (2.16.0)
dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2026-27194 Source advisory: OSV:PYSEC-2026-2461...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-27024 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-27024 Source advisory: OSV:PYSEC-2026-3013...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-27026 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-27026 Source advisory: OSV:PYSEC-2026-3015...
fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-27025 via pypdf (5.6.0)
pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-27025 Source advisory: OSV:PYSEC-2026-3024...
datasetpipeline (>=0.1.7, <=0.2.1), document-qa-engine (>=0.5.1, <=0.6.0) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.61)
langchain-core PYPI version 0.3.61 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - datasetpipeline =0.1.7, =0.5.1, =0.1.1, =0.1.7 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...
brainary (>=0.0.1, <=0.0.12), langchain-memvid (>=0.0.2, <=0.1.9) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.65)
langchain-core PYPI version 0.3.65 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - brainary =0.0.1, =0.0.2, =0.1.9 - opea-comps 1.4.0 - rigel-engine-core 5.0.0 Source cves: CVE-2026-26013 Source advisory:...
prodpadlm-client (>=0.1.1, <=0.1.1.3.1) potentially affected by CVE-2026-26013 via langchain-core (0.1.40)
langchain-core PYPI version 0.1.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - prodpadlm-client =0.1.1, =0.1.1.3.1 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...
