34769 matches found
PT-2026-104366
Name of the Vulnerable Software and Affected Versions TaskingAI version 0.3.0 Description In the DALL-E 3 image generation tool, the save url image function contains a path traversal flaw. This allows attackers to write downloaded images to arbitrary locations on the server filesystem by...
JetBrains YouTrack < 2026.2.18991 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18991. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification template...
umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57177 via social-auth-core (4.5.3)
social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...
argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.5.6)
social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...
umap-project (>=1.3.0a0, <=1.14.0a5) potentially affected by CVE-2026-57175 via social-auth-core (4.4.2)
social-auth-core PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.3.0a0, =1.14.0a5 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57175 via social-auth-core (4.8.1)
social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57177 via social-auth-core (4.8.5)
social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...
umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2026-57175 via social-auth-core (1.1.0)
social-auth-core PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57175 via social-auth-core (4.5.3)
social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
umap-project (>=2.0.0a0, <=2.0.0a2) potentially affected by CVE-2026-57175 via social-auth-core (4.5.2)
social-auth-core PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a0, =2.0.0a2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.5.6)
social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
centurion-erp (>=1.28.0rc1, <=1.29.0), galaxy (>=26.0.0, <=26.0.1) +1 more potentially affected by CVE-2026-57175 via social-auth-core (4.8.3)
social-auth-core PYPI version 4.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - centurion-erp =1.28.0rc1, =26.0.0, =3.6.0, =3.6.1 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57177 via social-auth-core (4.8.1)
social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...
netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57175 via social-auth-core (4.8.5)
social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...
MPXJ: XXE Vulnerability in MerlinReader
ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...
PYSEC-2026-4180 wlc may disclose API tokens to project-configured URLs
Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...
wlc may disclose API tokens to project-configured URLs
Impactwlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, w...
django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2026-15307 via django (2.1.5)
django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...
