6448 matches found
PYSEC-2026-2782 Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines
Summary A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer. Impac...
PYSEC-2026-2793 Open Babel has out-of-bounds write in Gaussian coords_type orientation parser
Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordstype orientation parser inside the Gaussian output reader. A malformed orientation block caused the parser to write past...
PYSEC-2026-2776 Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow
Summary A memory-safety vulnerability in Open Babel's bundled zipstream decompression code caused an out-of-bounds write via overlapping memcpy when reading a crafted gzip-compressed chemistry file. Details The flaw was in basicunzipstreambuf::underflow. The decompression buffer refill path invok...
PYSEC-2026-2432 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...
PYSEC-2026-2488 Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
Summary The ConformityCheck class in giskard-checks rendered the rule parameter through Jinja2's default Template constructor. Because the rule string is silently interpreted as a Jinja2 template, a developer may not realize that template expressions embedded in rule definitions are evaluated at...
PYSEC-2026-2794 OpenChatBI has a Path Traversal Vulnerability in save_report Tool
Impact The savereport tool in openchatbi/tool/savereport.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the fileformat parameter. The function only removes leading dots of fileformat using fileformat.lstrip"." but allows path traversal sequences...
PYSEC-2026-3013 pypdf has a possible infinite loop when processing TreeObject
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. Patches This has been fixed in pypdf==6.7.1. Workarounds If you cannot upgrade yet, consider applying the changes...
PT-2026-59417
Summary A memory-safety vulnerability in Open Babel's ChemKin parser caused a heap buffer overflow when reading a crafted input file. Details The flaw was in ChemKinFormat::CheckSpecies. A malformed species record caused the parser to write past the end of a heap-allocated buffer. Impact Open Bab...
CVE-2026-8932 affecting package curl for versions less than 8.11.1-10
CVE-2026-8932 affecting package curl for versions less than 8.11.1-10. A patched version of the package is available...
CVE-2026-59997 affecting package openssh for versions less than 9.8p1-9
CVE-2026-59997 affecting package openssh for versions less than 9.8p1-9. A patched version of the package is available...
CVE-2026-10536 affecting package curl for versions less than 8.11.1-10
CVE-2026-10536 affecting package curl for versions less than 8.11.1-10. A patched version of the package is available...
CVE-2026-8926 affecting package curl for versions less than 8.11.1-10
CVE-2026-8926 affecting package curl for versions less than 8.11.1-10. A patched version of the package is available...
CVE-2026-60000 affecting package openssh for versions less than 9.8p1-9
CVE-2026-60000 affecting package openssh for versions less than 9.8p1-9. A patched version of the package is available...
CVE-2026-8286 affecting package curl for versions less than 8.11.1-10
CVE-2026-8286 affecting package curl for versions less than 8.11.1-10. A patched version of the package is available...
CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9
CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9. A patched version of the package is available...
CVE-2026-39822 affecting package golang for versions less than 1.25.12-1
CVE-2026-39822 affecting package golang for versions less than 1.25.12-1. A patched version of the package is available...
CVE-2026-58013 affecting package glib for versions less than 2.78.6-10
CVE-2026-58013 affecting package glib for versions less than 2.78.6-10. A patched version of the package is available...
CVE-2026-58011 affecting package glib for versions less than 2.78.6-10
CVE-2026-58011 affecting package glib for versions less than 2.78.6-10. A patched version of the package is available...