ai-parrot (>=0.5.0, <=0.5.16), aleksis-app-order (>=0.1.1, <=0.7.0.dev0) +11 more potentially affected by CVE-2026-49452 via weasyprint (61.2.0)

weasyprint PYPI version 61.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.5.0, =0.1.1, =1.0.0, =0.1.1, =3.3.0, =0.9.8, =21.9.1, =1.0.1, =3.12.27, =2.8.0, =2.10.1 - xblock-ai-eval 0.3.3 Source cves:...

Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

PYSEC-2026-767 Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2026-27982 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V...

aleksis-app-alsijil (>=3.0.0.dev0, <=3.0.0b0), aleksis-app-chronos (>=3.0.0.dev1, <=3.0.0b0) +40 more potentially affected by CVE-2026-27982 via django-allauth (0.63.6)

django-allauth PYPI version 0.63.6 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-app-alsijil =3.0.0.dev0, =3.0.0.dev1, =0.1.0, =2.0.0.dev0, =2.0.1.dev0, =3.0.0b0, =4.0.0.dev11, =4.0.0.dev15 and more Sourc...

aleksis (>=2023.1.0b0, <=2023.6.0b1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=2.0.0rc7.post0) +11 more potentially affected by CVE-2026-27982 via django-allauth (0.53.1)

django-allauth PYPI version 0.53.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.1.0b0, =2.0.0a3.dev0, =1.0.7.dev0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0a1, =1.0.0, =2.0.0b0, =3.0.0b3,...

aleksis (>=2022.6.0.post0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +31 more potentially affected by CVE-2025-65431 via django-allauth (0.51.0)

django-allauth PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 a...

aleksis (>=2023.1.0b0, <=2023.6.0b1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=2.0.0rc7.post0) +11 more potentially affected by CVE-2025-65430 via django-allauth (0.53.1)

django-allauth PYPI version 0.53.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.1.0b0, =2.0.0a3.dev0, =1.0.7.dev0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0a1, =1.0.0, =2.0.0b0, =3.0.0b3,...

aleksis-app-alsijil (>=3.0.0, <=3.0.1), aleksis-app-chronos (>=3.0.0, <=3.0.2) +18 more potentially affected by CVE-2025-65431 via django-allauth (0.56.1)

django-allauth PYPI version 0.56.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-app-alsijil =3.0.0, =3.0.0, =3.0.0, =2.0.0, =0.2.0, =0.5.0, =3.0.0, =3.1.0 - aleksis-app-stoelindeling 2.0.0 and more Sourc...

aleksis-app-alsijil (>=3.0.0, <=3.0.1), aleksis-app-chronos (>=3.0.0, <=3.0.2) +18 more potentially affected by CVE-2025-65430 via django-allauth (0.56.1)

django-allauth PYPI version 0.56.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-app-alsijil =3.0.0, =3.0.0, =3.0.0, =2.0.0, =0.2.0, =0.5.0, =3.0.0, =3.1.0 - aleksis-app-stoelindeling 2.0.0 and more Sourc...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65431 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...

aleksis (>=2022.6.0.post0, <=2023.6.1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=3.0.1) +97 more potentially affected by CVE-2025-65430 via django-allauth (>=0.24.1, <=65.12.1)

django-allauth PYPI version =0.24.1, =2022.6.0.post0, =2.0.0a3.dev0, =1.0.0, =2.0.0b0, =2.1.0, =2.0.0b0, =1.0.0.dev0, =0.1.0, =2.0.0b1.post0, =2.0.0b0, =0.1.0, =2.0.0b0, =1.0.0, =0.1.1, =2.0.0.dev0, =2.0.0.dev2 and more Source cves: CVE-2025-65430 Source advisory: MEND:CVE-2025-65430...

EUVD-2025-7678

Malicious code in bioql PyPI...

EUVD-2022-5974

Malicious code in bioql PyPI...

aleksis (>=1.0.0a4.dev0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +19 more potentially affected by CVE-2025-48383 via django-select2 (7.11.1)

django-select2 PYPI version 7.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aleksis =1.0.0a4.dev0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and...

CVE-2022-29773

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...

CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...

Files or Directories Accessible to External Parties

Overview aleksis-core is a This is the core of the AlekSIS framework and the official distribution see below. It bundles functionality for all apps, and utilities for developers and administrators. Affected versions of this package are vulnerable to Files or Directories Accessible to External...

CVE-2025-25683

The aleksis-core package (the core of the AlekSIS framework) is vulnerable to Incorrect Access Control , allowing unauthenticated users to access sensitive PDF files. An attacker can trigger the generation of a PDF file, identify its ID via a GraphQL request , and then iterate through IDs to acce...