22870 matches found
GO-2026-5888 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico
Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
SUSE CVE-2026-55380
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile.open read image dimensions from the GD 2.x header and stored them in self.size without calling Image.decompressionbombcheck, allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This iss...
PYSEC-2026-1264 Composio Eval Injection Vulnerability
In composiohq/composio version 0.4.3, the mathematicalcalculator endpoint uses the unsafe eval function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval function...
PYSEC-2026-1083 Aim allows denial of service due to no timeouts for some tracking server endpoints
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue...
PYSEC-2026-1724 Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
A vulnerability in open-webui/open-webui versions = 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery CSRF. The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious...
PYSEC-2026-1457 HyperLPR Denial of Service vulnerability
A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service DoS attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malformed multipart requests with arbitrary...
PYSEC-2026-1092 Aim Stored Cross-site Scripting Vulnerability
A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...
WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin FormyChat versions = 2.15.3...
CVE-2026-53481
creationtimestamp| type| source ---|---|--- 2026-07-07 13:14:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2op7m3ox2g 2026-07-07 13:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116878935892069928 2026-07-07 13:30:31+00:00| seen|...
MAL-2026-9828 Malicious code in zw_nobdr_week3 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1148 Improper Certificate Validation vulnerability in Apache Airflow FTP Provider
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTPTLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.createdefaultcontext during FTPTLS...
PYSEC-2026-1317 Reflected XSS Vulnerability in dpaste
Impact A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized...
PYSEC-2026-1840 Pyramid static view path traversal up one directory
Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...
PYSEC-2026-996 TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`
Impact When tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status. cpp Status SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...
EUVD-2026-42028
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...
Important: Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
CVE-2026-14345
creationtimestamp| type| source ---|---|--- 2026-07-07 07:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpzztvnlvk27 2026-07-07 07:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpzzzjzvit2d 2026-07-07 07:21:51+00:00| seen|...
CVE-2026-57871
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3...
CVE-2026-57867
CVE-2026-57867 affects MicroRealEstate before or up to 1.0.0-alpha3, due to a lack of token state management that enables adversaries to bypass authentication and brute‑force One‑Time Passwords (OTP) to log in as any user. The root cause is insufficient token state handling, leading to an auth by...