edgy-project (>=0.1.12, <=0.1.15), fallixy (0.18.1) +5 more potentially affected by CVE-2024-52804 via tornado (4.4.3)

tornado PYPI version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - edgy-project =0.1.12, =0.18.1, =0.1.2, =0.9.0, =1.2.1 - pymultitor 2.1.0 Source cves: CVE-2024-52804 Source advisory: OSV:PYSEC-2026-1975...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2024-45231 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2024-45231 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2024-45231 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2024-45231 Source advisory:...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2024-45231 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

py-ms (2.1.0), sprite-hoai-thu (0.0.0) +3 more potentially affected by CVE-2024-5569 via zipp (2.0.0)

zipp PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - py-ms 2.1.0 - sprite-hoai-thu 0.0.0 - sprite-sheet-project =1.1.1, =0.0.0, =0.0.1 - spriteutil-kv 1.0.1 Source cves: CVE-2024-5569 Source advisory:...

Remote Code Execution in create_conda_env function in lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-49487 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-49487 Source advisory: OSV:GHSA-22HF-VX2V-GJFF...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-48891 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-48828 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-48828 Source advisory: OSV:GHSA-563F-2439-RMQ4...

Malicious code in @bmg-web/bmg-snackbar (npm)

--- -= Per source details. Do not edit below this line.=-...

umap-project (0.8.3) potentially affected by CVE-2024-32879 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-1931...

rest-social-auth (>=1.3.0, <=1.4.0), saltdash (>=0.9.1, <=0.9.5) +1 more potentially affected by CVE-2024-32879 via social-auth-app-django (2.1.0)

social-auth-app-django PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - rest-social-auth =1.3.0, =0.9.1, =1.0.0rc1, =1.0.0rc8 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-19...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2024-32879 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-1931...

PYSEC-2026-1763 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

PDM Trojan Lockfile

SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...

PYSEC-2026-1456 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...

Denial of service in neutron

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...