PYSEC-2026-1468 OpenStack Ironic fails to verify checksums of supplied image_source URLs

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied imagesource URLs when configured to convert images to a raw format for streaming...

CVE-2025-64636

creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...

CVE-2019-16728

creationtimestamp| type| source ---|---|--- 2026-07-07 14:02:53+00:00| seen| https://gist.github.com/UltraRamy/b344c7471b63468d9b5bc7bd3f33c59c...

CVE-2026-54234

creationtimestamp| type| source ---|---|--- 2026-07-07 14:01:40+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq2rebevqb2j 2026-07-17 18:35:04+00:00| published-proof-of-concept| https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f...

CVE-2026-53481

creationtimestamp| type| source ---|---|--- 2026-07-07 13:14:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2op7m3ox2g 2026-07-07 13:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116878935892069928 2026-07-07 13:30:31+00:00| seen|...

CVE-2026-53483

creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...

MAL-2026-7174 Malicious code in angulmrjs (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-4FH7-7JX4-8F6C apache-airflow DAG source authorization bypass exposes co-located DAG source

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

apache-airflow DAG source authorization bypass exposes co-located DAG source

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dagid — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...

CVE-2026-11348

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...

MAL-2026-9021 Malicious code in trye0zz (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8254 Malicious code in oaijgitwelcpe (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lp489 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in lambjanonlym (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-2060 ydata cross-site scripting

A cross-site scripting XSS vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser...

PYSEC-2026-1653 mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

PYSEC-2026-1650 mlflow Path Traversal vulnerability

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...

PYSEC-2026-2033 WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. Patches Fixed by 734ee8e that’s included in 61.2 Workarounds - Check that no PDF...

PYSEC-2026-1799 Cross-Site Request Forgery vulnerability in Prefect

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API...

CVE-2026-14476

creationtimestamp| type| source ---|---|--- 2026-07-07 11:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2iytgfgd2a 2026-07-20 13:12:20+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mr3enz3dlw2l 2026-07-20 14:14:46+00:00| seen|...