intake-bluesky (0.1.0a5) potentially affected by CVE-2026-33310 via intake (0.4.4)

intake PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-bluesky 0.1.0a5 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

access-nri-intake (>=0.1.1, <=0.1.4), aqua-core (>=0.21.0, <=1.0.0a4) +16 more potentially affected by CVE-2026-33310 via intake (0.7.0)

intake PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - access-nri-intake =0.1.1, =0.21.0, =0.4.3, =0.1.0, =0.11.0, =0.0.0, =0.1.3, =2024.2.1, =0.0.12, =0.4.5, =0.5.0, =0.7.4 and more Source cves:...

PYSEC-2026-2185

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

CVE-2026-33310 Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

CVE-2026-33310 Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

CVE-2026-33310

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

CVE-2026-33310 Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

Input code injection vulnerability

Intake is an open-source Python toolkit for data loading and processing. Versions of Intake prior to 2.0.9 had a code injection vulnerability. This vulnerability stemmed from the automatic expansion of shell syntax during directory parsing, which could lead to the execution of host system command...

intake-bluesky (0.1.0a5) potentially affected by CVE-2026-33310 via intake (0.4.4)

intake PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-bluesky 0.1.0a5 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

bluesky-cartpole (0.1.0) potentially affected by CVE-2026-33310 via intake (0.6.0)

intake PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - bluesky-cartpole 0.1.0 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

apsbits (>=1.0.0rc2, <=2.0.4), apstools (>=1.6.5rc3, <=1.8.0rc1) +34 more potentially affected by CVE-2026-33310 via intake (0.6.4)

intake PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - apsbits =1.0.0rc2, =1.6.5rc3, =1.1.0, =0.8.0, =0.1.0, =1.10.5, =0.1.1, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.1, =0.1.0, =0.1.3 and more Source cves:...

access-nri-intake (>=0.1.1, <=0.1.4), aqua-core (>=0.21.0, <=1.0.0a4) +16 more potentially affected by CVE-2026-33310 via intake (0.7.0)

intake PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - access-nri-intake =0.1.1, =0.21.0, =0.4.3, =0.1.0, =0.11.0, =0.0.0, =0.1.3, =2024.2.1, =0.0.12, =0.4.5, =0.5.0, =0.7.4 and more Source cves:...

hypycube (0.0.0a0) potentially affected by CVE-2026-33310 via intake (0.5.5)

intake PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - hypycube 0.0.0a0 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

intake-sqlite (>=0.1.0, <=0.1.2), rubicon-ml (>=0.3.4, <=0.3.7) potentially affected by CVE-2026-33310 via intake (0.6.5)

intake PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-sqlite =0.1.0, =0.3.4, =0.3.7 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

climakitae (>=1.0.0, <=1.0.1), climakitaegui (1.0.1) +2 more potentially affected by CVE-2026-33310 via intake (0.6.6)

intake PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - climakitae =1.0.0, =0.3.8, =0.4.3 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

access-intake-esm (>=2026.4.17, <=2026.8.13), access-nri-intake (>=0.0.2, <=1.8.1) +154 more potentially affected by CVE-2026-33310 via intake (>=2.0.0a2, <=2.0.9)

intake PYPI version =2.0.0a2, =2026.4.17, =0.0.2, =0.1.0a1, =1.5.0rc1, =1.0.0a5, =2024.6.4.1, =0.1.0a1, =1.0.0, =0.2.0, =0.1.0, =0.5.0, =0.6.2 and more Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

intake-dal (>=0.1.6, <=0.1.9) potentially affected by CVE-2026-33310 via intake (0.5.4)

intake PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-dal =0.1.6, =0.1.9 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

empiarreader (>=0.0.1, <=0.0.4), gdptools (>=0.0.2.dev0, <=0.0.22.dev0) +3 more potentially affected by CVE-2026-33310 via intake (0.6.8)

intake PYPI version 0.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - empiarreader =0.0.1, =0.0.2.dev0, =2021.1.0a1, =0.1.0, =0.1.2 Source cves: CVE-2026-33310 Source advisory: OSV:GHSA-37G4-QQQV-7M99...

access-intake-esm (>=2026.4.17, <=2026.8.13), access-nri-intake (>=0.0.2, <=1.8.1) +154 more potentially affected by CVE-2026-33310 via intake (>=2.0.0a2, <=2.0.9)

intake PYPI version =2.0.0a2, =2026.4.17, =0.0.2, =0.1.0a1, =1.5.0rc1, =1.0.0a5, =2024.6.4.1, =0.1.0a1, =1.0.0, =0.2.0, =0.1.0, =0.5.0, =0.6.2 and more Source cves: CVE-2026-33310 Source advisory: GHSA-37G4-QQQV-7M99...

CVE-2026-27839 wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three nutritionalvalues action endpoints fetch objects via Model.objects.getpk=pk — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition...