alpaxa-quant (>=1.0.0, <=1.0.2), amazon-wishlist-exporter (2024.12.7) +118 more potentially affected by CVE-2026-33752 via curl-cffi (>=0.5.6, <=0.14.0)

curl-cffi PYPI version =0.5.6, =1.0.0, =0.1.0, =1.1.5, =2.0.0, =1.0.0, =0.1.0a4, =0.9.16, =2.0.0, =0.1.0, =0.1.0, =0.3.0b22, =0.3.1 and more Source cves: CVE-2026-33752 Source advisory: OSV:PYSEC-2026-2431...

PYSEC-2026-2924 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

Summary passthrough and apassthrough in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request when the litellm primary path raises AttributeError. No URL scheme validation, private IP filtering, or domain allowlist is...

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

SummaryAn issue has been identified in the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 that may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. ImpactA remote actor could inject code during the build process, leadin...

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.You shoul...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-25604 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-236...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-25604 Source advisory:...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-256...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-236...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

airgoodies (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.7.1)

apache-airflow-providers-amazon PYPI version 8.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airgoodies =0.0.3, =0.0.4 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

airflow-providers (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (5.1.0)

apache-airflow-providers-amazon PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-providers =0.1.0, =0.3.0 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

airflow-toolkit (0.13.3), airflow-tools (>=0.9.0, <=0.12.0) +4 more potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (>=9.0.0, <=9.17.0)

apache-airflow-providers-amazon PYPI version =9.0.0, =0.9.0, =0.0.1, =2.10.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-pqc AWS Secrets Manager Key-Metadata Unsafe Deserializat...

EUVD-2026-43249

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...

PT-2026-59026

Summary Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a...

PT-2026-59020

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

PT-2026-59043

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

CVE-2026-61448: Unrestricted Upload of File with Dangerous Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...