delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-113714 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113714 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113718 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113720 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...

delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-113720 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113723 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113715 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-113719 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-113719 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

aamutils (0.0.11), adversarial-workflow (>=0.4.0, <=0.9.8) +175 more potentially affected by CVE-2026-112398 via pillow (12.1.1)

pillow PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aamutils 0.0.11 - adversarial-workflow =0.4.0, =1.1.0, =1.3.0, =0.1.0, =0.6.0, =26.3.14, =0.5.2b3, =0.1.3, =0.2.2, =3.1.0, =3.7.4 and more Source...

CVE-2026-57142

The PraisonAI multi-agent system (versions &gt;= 4.5.87 and

CVE-2026-57142 PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allowdangeroustools=True. That policy only checks tools declared in...

Oracle E-Business Suite (October 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are...

CVE-2026-54532

CloudPirates Open Source Helm Charts are vulnerable to cache poisoning and OIDC token theft in the pull_request_target workflow prior to commit 271d415 . The root cause is that the workflow checks out code from forks using github.event.pull_request.head.sha or .head.ref, granting attacker-control...

EUVD-2026-108260

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

CVE-2026-54532 CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

CVE-2026-54532 CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-113721 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

CVE-2026-115454

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is no...

CVE-2026-115496

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible...