PT-2026-104430

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Distribution versions prior to 2.14.12 Amazon SageMaker Distribution versions prior to 3.9.12 Amazon SageMaker Distribution versions prior to 4.0.11 Amazon SageMaker Distribution versions prior to 4.1.11 Amazon SageMaker...

CVE-2026-104606: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

PT-2026-104367

In TaskingAI v0.3.0 in the QR Code Generator plugin save base64 image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project id parameter...

PT-2026-104366

Name of the Vulnerable Software and Affected Versions TaskingAI version 0.3.0 Description In the DALL-E 3 image generation tool, the save url image function contains a path traversal flaw. This allows attackers to write downloaded images to arbitrary locations on the server filesystem by...

JetBrains YouTrack < 2026.2.18991 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18991. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification template...

umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57177 via social-auth-core (4.5.3)

social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57175 via social-auth-core (4.8.5)

social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57175 via social-auth-core (4.8.1)

social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2026-57175 via social-auth-core (1.1.0)

social-auth-core PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=1.3.0a0, <=1.14.0a5) potentially affected by CVE-2026-57175 via social-auth-core (4.4.2)

social-auth-core PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.3.0a0, =1.14.0a5 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=2.0.0a3, <=2.2.0b0) potentially affected by CVE-2026-57175 via social-auth-core (4.5.3)

social-auth-core PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a3, =2.2.0b0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=2.0.0a0, <=2.0.0a2) potentially affected by CVE-2026-57175 via social-auth-core (4.5.2)

social-auth-core PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =2.0.0a0, =2.0.0a2 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.5.6)

social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

netbox-types (>=4.5.4, <=4.6.5), umap-project (>=3.6.2, <=3.7.3) potentially affected by CVE-2026-57177 via social-auth-core (4.8.5)

social-auth-core PYPI version 4.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - netbox-types =4.5.4, =3.6.2, =3.7.3 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

argilla-server (>=1.24.0rc3, <=2.8.0), extralit (0.1.0a5) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.5.6)

social-auth-core PYPI version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argilla-server =1.24.0rc3, =0.2.0, =3.0.0, =3.4.0 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

centurion-erp (>=1.28.0rc1, <=1.29.0), galaxy (>=26.0.0, <=26.0.1) +1 more potentially affected by CVE-2026-57175 via social-auth-core (4.8.3)

social-auth-core PYPI version 4.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - centurion-erp =1.28.0rc1, =26.0.0, =3.6.0, =3.6.1 Source cves: CVE-2026-57175 Source advisory: OSV:PYSEC-2026-4167...

umap-project (>=3.4.1, <=3.5.0) potentially affected by CVE-2026-57177 via social-auth-core (4.8.1)

social-auth-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =3.4.1, =3.5.0 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

MPXJ: XXE Vulnerability in MerlinReader

ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

PYSEC-2026-4180 wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

wlc may disclose API tokens to project-configured URLs

Impactwlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, w...