5125 matches found
PYSEC-2026-1160 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue...
JupyterLab vulnerable to potential authentication and CSRF tokens leak
ImpactUsers of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. PatchesJupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. WorkaroundsNo workaround has been identified, however users...
PYSEC-2026-1706 JupyterLab vulnerable to potential authentication and CSRF tokens leak
Impact Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. Workarounds No workaround has been identified, however users...
PYSEC-2026-1173 Apache Superset - Elevation of Privilege
Overview An attacker with access to the SQL Lab and the abuser and abuserrole tables can elevate his privileges to become administrator. Details On a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2023-4863 +1 more via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:PYSEC-2026-1794...
Apache Superset has incorrect authorization check
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability...
PYSEC-2026-1166 Apache Superset has incorrect authorization check
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability...
fairtool (0.2.1), nomad-lab (1.2.1) +2 more potentially affected by CVE-2022-42964 via pymatgen (2023.2.28)
pymatgen PYPI version 2023.2.28 is affected by a known vulnerability. The following packages have a transitive dependency on pymatgen and may be impacted: - fairtool 0.2.1 - nomad-lab 1.2.1 - nomad-material-processing =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2022-42964 Source advisory:...
Exploit for CVE-2026-14191
cve-id ⚡ Simple Usage Use this project only in safe and...
Exploit for CVE-2026-53359
cve-id ⚡ Simple Usage Use this project only in safe and...
Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft
CVE-2026-42980 Public Disclosure This repository contains the...
PT-2026-56256
Name of the Vulnerable Software and Affected Versions FluxInk Color Management Driver versions 1.0.7.2 through 1.0.7.5 Description The Color Management Driver TcnPeripheral64.sys allows a standard user account to achieve local privilege escalation. This is possible through arbitrary physical memo...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-54059 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-54059 Source advisory: OSV:PYSEC-2026-2253...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-54060 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-54060 Source advisory: OSV:PYSEC-2026-2254...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-55379 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-55379 Source advisory: OSV:PYSEC-2026-2255...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-55380 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-55380 Source advisory: OSV:PYSEC-2026-2256...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-55798 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-55798 Source advisory: OSV:PYSEC-2026-2257...
lab-security-exploitable
No d...