Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure Vulnerability Summary Field | Value-- | --Title | Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap;...

PYSEC-2026-2973 py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

Summary PackInfo.read uses an On^2 cumulative sum pattern where numstreams is read directly from the archive header. A crafted .7z archive with a large numstreams value causes excessive CPU consumption during SevenZipFile.init — no extraction is needed. A 50 KB archive takes 7 seconds of CPU time...

vantage6-algorithm-store (4.6.0rc3), vantage6-node (4.6.0rc3) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.6.0rc3)

vantage6 PYPI version 4.6.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.6.0rc3 - vantage6-node 4.6.0rc3 - vantage6-server 4.6.0rc3 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.13.4), vantage6-node (4.13.4) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.13.4)

vantage6 PYPI version 4.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.13.4 - vantage6-node 4.13.4 - vantage6-server 4.13.4 Source cves: CVE-2026-54445 Source advisory: OSV:PYSEC-2026-340...

vantage6-algorithm-store (4.15.0rc4), vantage6-node (4.15.0rc4) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.15.0rc4)

vantage6 PYPI version 4.15.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.15.0rc4 - vantage6-node 4.15.0rc4 - vantage6-server 4.15.0rc4 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.3.1), vantage6-node (4.3.1) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.3.1)

vantage6 PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.3.1 - vantage6-node 4.3.1 - vantage6-server 4.3.1 Source cves: CVE-2026-54533 Source advisory: OSV:PYSEC-2026-3401...

vantage6-algorithm-store (4.6.0rc5), vantage6-node (4.6.0rc5) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.6.0rc5)

vantage6 PYPI version 4.6.0rc5 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.6.0rc5 - vantage6-node 4.6.0rc5 - vantage6-server 4.6.0rc5 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.7.0rc2), vantage6-node (4.7.0rc2) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.7.0rc2)

vantage6 PYPI version 4.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.7.0rc2 - vantage6-node 4.7.0rc2 - vantage6-server 4.7.0rc2 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.10.0rc2), vantage6-node (4.10.0rc2) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.10.0rc2)

vantage6 PYPI version 4.10.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.10.0rc2 - vantage6-node 4.10.0rc2 - vantage6-server 4.10.0rc2 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.5.3), vantage6-server (4.5.3) potentially affected by CVE-2026-54533 via vantage6 (4.5.3)

vantage6 PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.5.3 - vantage6-server 4.5.3 Source cves: CVE-2026-54533 Source advisory: OSV:PYSEC-2026-3401...

vantage6-algorithm-store (4.15.0rc4), vantage6-node (4.15.0rc4) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.15.0rc4)

vantage6 PYPI version 4.15.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.15.0rc4 - vantage6-node 4.15.0rc4 - vantage6-server 4.15.0rc4 Source cves: CVE-2026-54533 Source advisory:...

vantage6-algorithm-store (4.6.0), vantage6-node (4.6.0) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.6.0)

vantage6 PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.6.0 - vantage6-node 4.6.0 - vantage6-server 4.6.0 Source cves: CVE-2026-54445 Source advisory: OSV:PYSEC-2026-3400...

vantage6-algorithm-store (4.15.0rc1), vantage6-node (4.15.0rc1) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.15.0rc1)

vantage6 PYPI version 4.15.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.15.0rc1 - vantage6-node 4.15.0rc1 - vantage6-server 4.15.0rc1 Source cves: CVE-2026-54445 Source advisory:...

vantage6-algorithm-store (4.5.0), vantage6-node (4.5.0) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.5.0)

vantage6 PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.5.0 - vantage6-node 4.5.0 - vantage6-server 4.5.0 Source cves: CVE-2026-54445 Source advisory: OSV:PYSEC-2026-3400...

vantage6-algorithm-store (4.14.0rc1), vantage6-node (4.14.0rc1) +1 more potentially affected by CVE-2026-54445 via vantage6 (4.14.0rc1)

vantage6 PYPI version 4.14.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.14.0rc1 - vantage6-node 4.14.0rc1 - vantage6-server 4.14.0rc1 Source cves: CVE-2026-54445 Source advisory:...

PYSEC-2026-3401 vantage6 node has an Improper Access Control issue

Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...

vantage6-algorithm-store (4.10.1rc1), vantage6-node (4.10.1rc1) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.10.1rc1)

vantage6 PYPI version 4.10.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.10.1rc1 - vantage6-node 4.10.1rc1 - vantage6-server 4.10.1rc1 Source cves: CVE-2026-54533 Source advisory:...

vantage6-algorithm-store (4.13.2), vantage6-node (4.13.2) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.13.2)

vantage6 PYPI version 4.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.13.2 - vantage6-node 4.13.2 - vantage6-server 4.13.2 Source cves: CVE-2026-54533 Source advisory: OSV:PYSEC-2026-340...

vantage6-algorithm-store (4.13.1), vantage6-node (4.13.1) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.13.1)

vantage6 PYPI version 4.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.13.1 - vantage6-node 4.13.1 - vantage6-server 4.13.1 Source cves: CVE-2026-54533 Source advisory: OSV:PYSEC-2026-340...

vantage6-algorithm-store (4.10.1), vantage6-node (4.10.1) +1 more potentially affected by CVE-2026-54533 via vantage6 (4.10.1)

vantage6 PYPI version 4.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.10.1 - vantage6-node 4.10.1 - vantage6-server 4.10.1 Source cves: CVE-2026-54533 Source advisory: OSV:PYSEC-2026-340...