fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2024-6345 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-19...

PT-2026-61760

Name of the Vulnerable Software and Affected Versions praisonai versions 3.11.0 through 4.6.58 Description The Slack bot in PraisonAI fails to apply configured user and channel authorization policies when processing app mention events. While the standard message event handler correctly enforces...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

EUVD-2026-19062

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

The CVE-2026-5557 entry concerns badlogic pi-mono up to version 0.58.4, affecting the pi-mom Slack Bot component’s file packages/mom/src/slack.ts. The documented issue results in an authentication bypass via an alternate channel, with remote execution possible. Public exploitation is noted. No ve...

CVE-2026-5557: Authentication Bypass Using an Alternate Path or Channel

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

backlogprocessing (>=0.0.0, <=0.0.2), commit-helper (>=3.4.15, <=3.4.16) +9 more potentially affected by CVE-2026-1703 via pip (19.0.3)

pip PYPI version 19.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - backlogprocessing =0.0.0, =3.4.15, =0.0.37, =2.3.7.19022609, =1.4.0, =2019.3.2, =0.0.1, =0.0.14, =0.9.1, =0.9.2 Source cves: CVE-2026-1703 Source advisor...

EUVD-2024-30656

Malicious code in bioql PyPI...

EUVD-2025-6919

Malicious code in bioql PyPI...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory:...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-4...

CVE-2024-8065

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

PT-2025-12218

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version v1.4.1 Description A Cross-Site Request Forgery CSRF issue allows attackers to perform unauthorized actions in the context of the victim's browser, including connecting the victim's application with a malicious Slack...

CVE-2024-8065: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-32881

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...