dcicsnovault (>=2.0.0b4, <=2.0.0b7), ethyca-fides (>=2.10.0, <=2.13.0) +2 more potentially affected by CVE-2026-77401 via accesscontrol (>=4.4.0, <=6.0.0)

accesscontrol PYPI version =4.4.0, =2.0.0b4, =2.10.0, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: MEND:CVE-2026-77401...

CVE-2026-77401: Protection Mechanism Failure

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

PT-2026-93792

Name of the Vulnerable Software and Affected Versions Zope AccessControl versions prior to 7.4 Description Applications that allow untrusted users to create and execute AccessControl-controlled Python code fail to safely guard str.format and str.format map when accessed through a str subclass. In...

EUVD-2026-58717

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...

CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...

CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization

CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...

EUVD-2026-54828

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985: Improper Neutralization of Special Elements used in an OS Command

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985 MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985 MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands with root privileges on the underlying system. Affected product: MSI Radix AXE6600 (firmware v781521). Vulnerable c...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

PT-2026-69233

Name of the Vulnerable Software and Affected Versions MSI Radix AXE6600 version v781521 Description A command injection issue exists in the accesscontrol function. This allows remote attackers to execute arbitrary commands on the device and obtain root privileges on the underlying system...

CVE-2026-65530 WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2024-51734 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2024-51734 Source advisory: OSV:PYSEC-2026-2326...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2024-51734 via accesscontrol (4.4.0)

accesscontrol PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - dcicsnovault =2.0.0b4, =4.6.3, =4.8.11 Source cves: CVE-2024-51734 Source advisory: OSV:PYSEC-2026-2326...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2023-41050 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2023-41050 Source advisory: OSV:PYSEC-2026-2325...

Information disclosure in AccessControl

ImpactPython's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

PT-2026-59009

Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...