python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-1703 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-1703 Source advisory: OSV:PYSEC-2026-1796...

amundsen-metadata (>=1.0.18, <=2.5.4), amundsen-search (>=2.4.1, <=2.5.1) +8 more potentially affected by CVE-2025-66221 via werkzeug (0.15.3)

werkzeug PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =1.0.18, =2.4.1, =0.0.1, =0.0.6, =0.9.94, =0.0.1, =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2025-66221 Source advisory:...

amundsen-metadata (>=1.0.18, <=2.5.4), amundsen-search (>=2.4.1, <=2.5.1) +8 more potentially affected by CVE-2024-49766 via werkzeug (0.15.3)

werkzeug PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =1.0.18, =2.4.1, =0.0.1, =0.0.6, =0.9.94, =0.0.1, =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-49766 Source advisory:...

aileen (>=0.2.0.dev20181221, <=0.2.1), scdna-replication-tools (0.0.1) potentially affected by CVE-2024-45231 via django (1.11.16)

django PYPI version 1.11.16 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aileen =0.2.0.dev20181221, =0.2.1 - scdna-replication-tools 0.0.1 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

PYSEC-2026-1266 Composio Code Injection Vulnerability

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

lgblkb-tools (>=1.0.60, <=1.0.62), qwgc (0.0.3) +3 more potentially affected by CVE-2024-5569 via zipp (2.1.0)

zipp PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - lgblkb-tools =1.0.60, =1.0.2, =0.1.3, =1.0.0, =1.0.2 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-2074...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2024-6345 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

h2o vulnerable to unexpected POST request shutting down server

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

PYSEC-2026-1437 h2o vulnerable to unexpected POST request shutting down server

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

Malicious code in @indriver-tools/whisperwind (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7076 Malicious code in @indriver-tools/whisperwind (npm)

--- -= Per source details. Do not edit below this line.=-...

amundsen-metadata (>=1.0.18, <=2.5.4), amundsen-search (>=2.4.1, <=2.5.1) +8 more potentially affected by CVE-2024-34069 via werkzeug (0.15.3)

werkzeug PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =1.0.18, =2.4.1, =0.0.1, =0.0.6, =0.9.94, =0.0.1, =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-34069 Source advisory:...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2023-50782 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2024-0727 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

keras-pandas (>=1.1.2, <=2.0.1), learna-tools (0.1.0) potentially affected by CVE-2022-41894 via tensorflow (1.4.0)

tensorflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - keras-pandas =1.1.2, =2.0.1 - learna-tools 0.1.0 Source cves: CVE-2022-41894 Source advisory: OSV:PYSEC-2026-936...

PYSEC-2026-1059 OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-48892 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-48892 Source advisory:...

RHSA-2026:35833 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

Medium: aws-nitro-tpm-tools

Issue Overview: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0...