PYSEC-2026-1437 h2o vulnerable to unexpected POST request shutting down server

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-33264 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-33264 Source advisory:...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-33264 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-33264 Source advisory:...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-33264 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-33264 Source advisory:...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-48892 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-48892 Source advisory:...

Malicious code in @indriver-tools/whisperwind (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7076 Malicious code in @indriver-tools/whisperwind (npm)

--- -= Per source details. Do not edit below this line.=-...

amundsen-metadata (>=1.0.18, <=2.5.4), amundsen-search (>=2.4.1, <=2.5.1) +8 more potentially affected by CVE-2024-34069 via werkzeug (0.15.3)

werkzeug PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =1.0.18, =2.4.1, =0.0.1, =0.0.6, =0.9.94, =0.0.1, =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-34069 Source advisory:...

actinia-core (>=4.11.0, <=4.13.1), agentic-ai-vass-tools (>=0.1.0, <=0.4.0) +131 more potentially affected by CVE-2024-34069 via werkzeug (>=3.0.0, <=3.0.2)

werkzeug PYPI version =3.0.0, =4.11.0, =0.1.0, =0.9.9, =0.0.1, =0.0.12, =3.2.2, =0.1.0, =1.0.1, =0.7.64, =0.0.5.dev0, =0.0.8 and more Source cves: CVE-2024-34069 Source advisory: OSV:PYSEC-2026-2043...

cumulusci (>=2.5.6, <=3.7.0), lgblkb-tools (>=1.0.60, <=1.0.66) +2 more potentially affected by CVE-2024-28102 via jwcrypto (0.6.0)

jwcrypto PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - cumulusci =2.5.6, =1.0.60, =0.0.0, =1.4.5, =1.7.0 Source cves: CVE-2024-28102 Source advisory: OSV:PYSEC-2026-1484...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2023-50782 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2024-0727 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

keras-pandas (>=1.1.2, <=2.0.1), learna-tools (0.1.0) potentially affected by CVE-2022-41894 via tensorflow (1.4.0)

tensorflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - keras-pandas =1.1.2, =2.0.1 - learna-tools 0.1.0 Source cves: CVE-2022-41894 Source advisory: OSV:PYSEC-2026-936...

PYSEC-2026-1059 OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-48892 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-48892 Source advisory:...

RHSA-2026:35833 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

SUSE SLED15: cryptsetup / cryptsetup-doc / cryptsetup-lang / cryptsetup-ssh / etc (SUSE-SU-2026:2777-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2777-1 advisory. This update for cryptsetup, s390-tools fixes the following issue Security fixes: - CVE-2026-41676: openssl:...

CVE-2026-50810

A NULL pointer dereference in smoothparsestreamindex in src/mediatools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 allows attackers to cause a denial of service...

Medium: aws-nitro-tpm-tools

Issue Overview: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should upgrade to AWS-LC 1.71.0...