aimet-torch (1.31.1), hail (>=0.2.15, <=0.2.61) +2 more potentially affected by CVE-2026-21883 via bokeh (1.2.0)

bokeh PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - aimet-torch 1.31.1 - hail =0.2.15, =0.2.53, =99.2.58 - outerspace 0.1.0 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1223...

cami-amber (>=2.0.0, <=2.0.3), cami-opal (1.0.11) +5 more potentially affected by CVE-2026-21883 via bokeh (0.13.0)

bokeh PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - cami-amber =2.0.0, =2.2.0, =0.2.1, =1.3.0, =2.0.7 - spade-bokeh 0.1.2 - wizardhat 0.2.0 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1...

A puppet made me cry and all I got was this t-shirt

Welcome to this week's edition of the Threat Source newsletter. Anyone who spoke with me in the last several weeks has had to deal with me loudly waiting in anticipation for the long-awaited "Project Hail Mary" movie adaptation. I read and cried over the book by Andy Weir, who's also the author o...

aimet-torch (1.31.1), hail (>=0.2.15, <=0.2.61) +2 more potentially affected by CVE-2026-21883 via bokeh (1.2.0)

bokeh PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - aimet-torch 1.31.1 - hail =0.2.15, =0.2.53, =99.2.58 - outerspace 0.1.0 Source cves: CVE-2026-21883 Source advisory: OSV:GHSA-793V-589G-574V...

cami-amber (>=2.0.0, <=2.0.3), cami-opal (1.0.11) +5 more potentially affected by CVE-2026-21883 via bokeh (0.13.0)

bokeh PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - cami-amber =2.0.0, =2.2.0, =0.2.1, =1.3.0, =2.0.7 - spade-bokeh 0.1.2 - wizardhat 0.2.0 Source cves: CVE-2026-21883 Source advisory:...

backtrader-plotting (1.0.0), biocrnpyler (0.2.1) +31 more potentially affected by CVE-2026-21883 via bokeh (1.4.0)

bokeh PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - backtrader-plotting 1.0.0 - biocrnpyler 0.2.1 - chartify =2.3.4, =0.2.78, =0.10.0, =0.8.0, =0.4.0, =0.1.0, =0.2.76, =0.1.0a1, =0.10.1.post1, =0.7.4,...

awsglue-local (>=0.9.1, <=1.0.2), ceja (0.1.0) +13 more potentially affected by CVE-2025-55039 via pyspark (2.4.8)

pyspark PYPI version 2.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - awsglue-local =0.9.1, =0.2.1, =0.0.12, =0.1.0, =0.1.0, =1.3.1, =2.0.0b0, =1.0.2rc1, =2.4.0rc1, =0.0.2, =0.2.0, =0.5.1 Source cves: CVE-2025-55039...

hail (>=0.2.14, <=0.2.64), j11hail (0.2.53) +2 more potentially affected by CVE-2025-55039 via pyspark (2.4.1)

pyspark PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - hail =0.2.14, =0.1.0, =0.1.0, =0.1.4 Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...

analytics-zoo (0.2.0), hail (>=0.2.1, <=0.2.12) potentially affected by CVE-2025-55039 via pyspark (2.2.3)

pyspark PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.2.0 - hail =0.2.1, =0.2.12 Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...

hail (>=0.2.14, <=0.2.64), j11hail (0.2.53) +2 more potentially affected by CVE-2025-55039 via pyspark (2.4.1)

pyspark PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - hail =0.2.14, =0.1.0, =0.1.0, =0.1.4 Source cves: CVE-2025-55039 Source advisory: OSV:PYSEC-2025-184...

analytics-zoo (0.2.0), hail (>=0.2.1, <=0.2.12) potentially affected by CVE-2025-55039 via pyspark (2.2.3)

pyspark PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.2.0 - hail =0.2.1, =0.2.12 Source cves: CVE-2025-55039 Source advisory: OSV:PYSEC-2025-184...

CVE-2023-51663

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

Authentication Bypass

hail is is vulnerable to Authentication Bypass. The vulnerability is due to improper validation while handling OpenID Connect OIDC email addresses. This lack of verification of the user's email domain allows an attacker to manipulate their email address to match an organization's domain with...

CVE-2023-51663

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

Design/Logic Flaw

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

PYSEC-2023-271

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

PYSEC-2023-271

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

CVE-2023-51663 Hail authentication can be bypassed by changing email address

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...

CVE-2023-51663

Hail authentication issue (CVE-2023-51663) affects Hail with Hail Batch accounts. Root cause: relying on OIDC email addresses to verify user domain; users can change their emails, enabling creation of Hail Batch accounts in domains they shouldn’t access. Impact stated: attacker cannot access priv...

CVE-2023-51663 Hail authentication can be bypassed by changing email address

Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...