SageMaker Workflow component allows possibility of MD5 hash collisions

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This...

PYSEC-2026-1885 SageMaker Workflow component allows possibility of MD5 hash collisions

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This...

PYSEC-2026-1923 sigstore has insufficient validation of integration timestamp during verification

Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...

datamorph-workflow-generator (0.0.2), i2b2-import (>=0.0.1, <=1.5.34) +1 more potentially affected by CVE-2024-45784 via airflow (0.6.0)

airflow PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on airflow and may be impacted: - datamorph-workflow-generator 0.0.2 - i2b2-import =0.0.1, =1.5.34 - pandasdb 0.0.10 Source cves: CVE-2024-45784 Source advisory: OSV:PYSEC-2026-111...

lm-eval (>=0.0.1, <=0.2.0), remote-sqlitedict (>=0.3.8, <=0.4.2) +1 more potentially affected by CVE-2024-35515 via sqlitedict (1.6.0)

sqlitedict PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlitedict and may be impacted: - lm-eval =0.0.1, =0.3.8, =1.1.0, =1.14.16 Source cves: CVE-2024-35515 Source advisory: OSV:PYSEC-2026-1939...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.7) +4 more potentially affected by CVE-2024-37300 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1...

code injection vulnerability exists in the huggingface/text-generation-inference repository

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

PYSEC-2026-1966 code injection vulnerability exists in the huggingface/text-generation-inference repository

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.7) +4 more potentially affected by CVE-2024-29033 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1...

aiida-fleur (1.1.0), aiida-sssp-workflow (>=4.0.0, <=4.2.1) +7 more potentially affected by CVE-2022-42964 via pymatgen (2024.5.31)

pymatgen PYPI version 2024.5.31 is affected by a known vulnerability. The following packages have a transitive dependency on pymatgen and may be impacted: - aiida-fleur 1.1.0 - aiida-sssp-workflow =4.0.0, =2022.1.24, =0.2.0, =0.0.121, =0.1.0a0, =1.2.17, =1.2.18 Source cves: CVE-2022-42964 Source...

PT-2026-56228

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description An improper access check allows unauthorized users to access workflow stage and transition information within the com workflow component. Recommendations At the moment, there is no...

CVE-2026-48955: Improper Access Control

An improper access check allows unauthorized users to access workflow stage and transition information...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +518 more potentially affected by CVE-2026-55379 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.13.0.dev20261023 and more Source cves: CVE-2026-55379 Source advisory: SNYK:PYTHON-PILLOW-17824468...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +518 more potentially affected by CVE-2026-55379 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.13.0.dev20261023 and more Source cves: CVE-2026-55379 Source advisory: OSV:PYSEC-2026-2255...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +518 more potentially affected by CVE-2026-55380 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.13.0.dev20261023 and more Source cves: CVE-2026-55380 Source advisory: OSV:PYSEC-2026-2256...

Malicious Package

Overview @thymelab/logfx is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

VulnClaw

🔍 VulnClaw - Automated Security Testing Using Artificial Intel...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the workflow approval process. An attacker can gain unauthorized access to protected resources or perform privileged actions by bypassing the intended approval gate through manipulation of permanent fork pull...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the workflow approval process. An attacker can gain unauthorized access to protected resources or perform privileged actions by bypassing the intended approval gate through manipulation of permanent fork pull...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the workflow approval process. An attacker can gain unauthorized access to protected resources or perform privileged actions by bypassing the intended approval gate through manipulation of permanent fork pull...