BigAnt Server 5.6.06 - Improper Access Control

BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-23348 info: name: BigAn...

Seagate NAS OS 4.3.15.1 - Server Information Disclosure

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. id: CVE-2018-12296 info: name: Seagate NAS OS 4.3.15.1 - Server Information...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

ImpactPython's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

PYSEC-2026-4022 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2026-77401 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2026-77401 Source advisory: OSV:PYSEC-2026-4022...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-77401 via accesscontrol (4.4.0)

accesscontrol PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - dcicsnovault =2.0.0b4, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: OSV:PYSEC-2026-4022...

PT-2026-105783

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

GHSA-PQ59-9FQ7-M886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2026-77401 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2026-77401 Source advisory: OSV:GHSA-PQ59-9FQ7-M886...

EUVD-2026-80790

Zope AccessControl vulnerable to information disclosure through Python string format and formatmap functions...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the format and formatmap functions of Python string subclasses. An attacker can access sensitive information by supplying crafted format strings that leverage unrestricted attribute and item access...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-77401 via accesscontrol (4.4.0)

accesscontrol PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - dcicsnovault =2.0.0b4, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: OSV:GHSA-PQ59-9FQ7-M886...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restrict...

CVE-2026-77401

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401

Zope AccessControl prior to version 7.4 is vulnerable to information disclosure through Python string str.format and str.format_map functions. When these methods are reached via a str subclass in applications allowing untrusted users to execute AccessControl-controlled Python code, formatting in ...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...