152 matches found
ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-102925 via virtualenv (20.4.3)
virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...
optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-102925 via virtualenv (20.4.7)
virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...
azure-devops-artifacts-helpers (>=1.0.8, <=1.0.9), hip-data-ml-utils (>=0.3.7, <=1.0.0) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.4.2)
virtualenv PYPI version 20.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers =1.0.8, =0.3.7, =8.2.1, =0.9.2, =1.1.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...
azure-devops-artifacts-helpers (>=1.0.8, <=1.0.9), hip-data-ml-utils (>=0.3.7, <=1.0.0) +2 more potentially affected by CVE-2026-102937 via virtualenv (20.4.2)
virtualenv PYPI version 20.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers =1.0.8, =0.3.7, =8.2.1, =0.9.2, =1.1.0 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...
optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-102937 via virtualenv (20.4.7)
virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...
ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-102930 via virtualenv (20.4.3)
virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...
ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-102937 via virtualenv (20.4.3)
virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...
optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-102930 via virtualenv (20.4.7)
virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...
CVE-2026-63405: Insufficient Verification of Data Authenticity
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...
PT-2026-95492
Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15 Description The Pusher-compatible REST API in pusher/http.go includes the caller-supplied body md5 value in the HMAC input but fails to calculate the digest of the received request body or compare it with the...
ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-102938 via virtualenv (20.4.3)
virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...
optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-102938 via virtualenv (20.4.7)
virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...
azure-devops-artifacts-helpers (>=1.0.8, <=1.0.9), hip-data-ml-utils (>=0.3.7, <=1.0.0) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.4.2)
virtualenv PYPI version 20.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers =1.0.8, =0.3.7, =8.2.1, =0.9.2, =1.1.0 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...
Potential access to sensitive URLs via CKAN extensions (SSRF)
ImpactThere are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local cop...
angular-cjk-word-break (>=0.1.0, <=0.1.1), angular-pusher-bridge (>=0.1.1, <=0.1.4) +2 more potentially affected by unknown CVE via angular (>=0.0.1, <=1.2.0)
angular NPM version =0.0.1, =0.1.0, =0.1.1, =0.0.1, =0.0.25 Source cves: unknown CVE Source advisory: MEND:WS-2017-0125...
CVE-2026-41308
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. Thi...
CVE-2026-41308
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. Thi...
CVE-2026-41308 Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. Thi...
EUVD-2026-28646
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. Thi...
CVE-2026-41308 Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. Thi...