gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-103261 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-103261 Source advisory: OSV:GHSA-3HV7-MJH2-FV6...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-103262 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-103262 Source advisory: OSV:GHSA-CHX6-46F5-W4V...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-103263 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-103263 Source advisory: OSV:GHSA-C2M8-H5V5-343...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-82397 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-82397 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-82397 Source advisory: OSV:GHSA-MPF4-983Q-P7J4...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2025-67726 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2025-67726 Source advisory: OSV:GHSA-JHMP-MQWM-3GQ8...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2025-67725 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2025-67725 Source advisory: OSV:GHSA-C98P-7WGM-6P64...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2025-67724 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2025-67724 Source advisory: OSV:GHSA-PR2V-JX2C-WG9F...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-49855 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-49855 Source advisory: OSV:PYSEC-2026-3389...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2025-47287 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2025-47287 Source advisory: OSV:PYSEC-2026-1974...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

EUVD-2026-39869

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

PT-2026-52913

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1 Description An Insecure Direct Object Reference IDOR exists in the project storage settings. A project administrator can gain unauthorized access to the managed Nextclou...

CVE-2026-52783: Cleartext Storage in a File or on Disk

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage. .httpxaccesstoken, repopulated continuously by an...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-49854 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-49854 Source advisory: OSV:GHSA-CX3H-4QPV-8HC9...

CVE-2026-47352 TYPO3 CMS - Broken Access Control in Backend API

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46,...

CVE-2026-47352 TYPO3 CMS - Broken Access Control in Backend API

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45,...

PT-2026-47745

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.51 TYPO3 CMS versions 12.0.0 through 12.4.46 TYPO3 CMS versions 13.0.0 through 13.4.31 TYPO3 CMS versions 14.0.0 through 14.3.3 Description Authenticated backend users...

gremlinpython (>=3.2.2rc1, <=3.3.0), shot-detector (>=0.0.4.dev68, <=0.0.5.dev3) +4 more potentially affected by CVE-2026-35536 via tornado (4.4.1)

tornado PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - gremlinpython =3.2.2rc1, =0.0.4.dev68, =0.1.0, =0.0.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-35536 Source advisory: OSV:PYSEC-2026-2287...