GHSA-FC2G-4W5P-6WHM virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

Origin Validation Error

Overview @azure/msal-node is a Microsoft Authentication Library for Node Affected versions of this package are vulnerable to Origin Validation Error via the acquireTokenByCode method in ConfidentialClientApplication, which fails to sanitize the caller-supplied authCodePayload before use. An...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

EUVD-2026-109182

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883

The LangGraph checkpoint savers, specifically the PostgresStore , AsyncPostgresStore , SqliteStore , and AsyncSqliteStore components, are vulnerable to a cross-namespace data access issue. The root cause is that these stores flatten namespace labels using ".".join(namespace), but validation only ...

Incorrect Authorization

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Incorrect Authorization

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

CVE-2026-98824

A flaw was found in the Linux kernel's mac80211 wireless subsystem. When processing transmission TX status reports, the subsystem fails to properly validate rate metadata before using it to index internal rate tables. Malformed metadata can trigger an out-of-bounds memory access, potentially...

CVE-2026-65825

OpenReception's appointment booking software (versions 2.1.0 and prior ) is vulnerable to a cross-tenant authentication bypass. A state owned by one tenant can disable the PIN brute-force throttle for the same identifier in other tenants, allowing an attacker to perform an online brute-force atta...

EUVD-2026-109156

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

CVE-2026-115877

The Twisted event-based framework (Python 3.6+) is vulnerable to HTTP Request Smuggling prior to version 26.10.0rc1 . The root cause is located in twisted.web.http.HTTPChannel.headerReceived, which rejects NUL bytes but incorrectly accepts bare carriage returns (CR) or line feeds (LF) in header v...