pypdf can exhaust RAM via manipulated LZWDecode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. PatchesThis has been fixed in pypdf==6.1.3. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR...

Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

PYSEC-2026-1206 AWS SAM CLI Path Traversal allows file copy to local cache

Summary The AWS Serverless Application Model Command Line Interface AWS SAM CLI is an open-source CLI tool that helps Lambda developers to build and develop Lambda applications locally on their computers using Docker. After completing a build with AWS SAM CLI which include symlinks, the content o...

Frappe has possibility of SQL injection due to improper validations

ImpactAn SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. WorkaroundsUpgrading is required, no other workaround is present. CreditsThanks to Thanh of Calif.io for reporting the issue...

Frappe has Possibility of Remote Code Execution due to improper validation

ImpactA system user was able to create certain documents in a specific way that could lead to RCE. WorkaroundsThere's no workaround, an upgrade is required. CreditsThanks to Thanh of Calif.io for reporting the issue...

PYSEC-2026-1392 Frappe vulnerable to information disclosure leading to account takeover

Impact Making crafted requests could lead to information disclosure that could further lead to account takeover. Workarounds There's no workaround to fix this without upgrading. Credits Thanks to Thanh of Calif.io for reporting the issue...

Frappe vulnerable to information disclosure leading to account takeover

ImpactMaking crafted requests could lead to information disclosure that could further lead to account takeover. WorkaroundsThere's no workaround to fix this without upgrading. CreditsThanks to Thanh of Calif.io for reporting the issue...

Frappe has possibility of SQL injection due to improper validations

ImpactSQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. WorkaroundsUpgrading is required, no other workaround is present...

PYSEC-2026-1391 Frappe has possibility of SQL injection due to improper validations

Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present...

PYSEC-2026-1393 Frappe has Possibility of Remote Code Execution due to improper validation

Impact A system user was able to create certain documents in a specific way that could lead to RCE. Workarounds There's no workaround, an upgrade is required. Credits Thanks to Thanh of Calif.io for reporting the issue...

Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see.When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

PYSEC-2026-1134 Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

Prevent XSS from Confidant API call

ImpactWhat kind of vulnerability is it? Who is impacted?Potential XSS from API calls below:GET /v1/credentialsGET /v1/credentials/GET /v1/archive/credentials/GET /v1/archive/credentialsPOST /v1/credentialsPUT /v1/credentials/PUT /v1/credentials//GET /v1/servicesGET /v1/services/GET...

XML External Entity (XXE) Injection

Overview ebookmeta is a Read/write ebook metadata for fb2, epub2 and epub3 files Affected versions of this package are vulnerable to XML External Entity XXE Injection in the ebookmeta.getmetadata function via lxml dependency allows attackers to access sensitive information or cause a Denial of...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the dep.source and dep.target fields in the scheduling graph endpoint. An attacker can obtain identifiers of resources they are not authorized to access by inspecting dependency information exposed...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the Config API when per-key secrets backend overrides are configured via...

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.The FTP hook lacks complete certificate validation in FTPTLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.createdefaultcontext during FTPTLS...

PYSEC-2026-1710 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Summary and impact GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domains. The...

PYSEC-2026-1184 Apache Superset SQL injection vulnerability

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which...

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendNote: thevulnerability is about the information exposed in the logs not abo...