galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57177 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57179 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, az, kubeflow-volumes-web-app, kserve, kubeflow-katib, k8s-sidecar, open-webui, dask-kubernetes, ggshield, jupyter-base-notebook, datadog-agent, kubeflow-jupyter-web-app, kubeflow-pipelines...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, az, kubeflow-volumes-web-app, kserve, kubeflow-katib, k8s-sidecar, open-webui, dask-kubernetes, ggshield, jupyter-base-notebook, datadog-agent, kubeflow-jupyter-web-app, kubeflow-pipelines...

CVE-2026-102806

OpenClaw versions before 2026.9.5 are affected by an incorrect authorization vulnerability in the Gateway's local media root allowlist. This flaw breaks filesystem isolation between sandboxed sessions, allowing sandboxed sessions or untrusted content to read files from sibling session sandboxes o...

CVE-2026-102806 OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57179 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57178 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57177 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57176 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

CVE-2026-52744

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-54168

A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...

CVE-2026-54167

A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...

CVE-2026-92129: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2026-54167

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54168

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54167

Pipelines-as-Code , a CI/CD system for defining Tekton pipelines in source repositories, is affected in its GitHub App provider . Prior to versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the provider accepts the X-GitHub-Enterprise-Host request header as the API host before webhook signature validat...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...