FastChat Server-Side Request Forgery vulnerability

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

PYSEC-2026-1396 FastChat Server-Side Request Forgery vulnerability

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

django-amazon-price-monitor (>=0.3.0b2, <=0.4.0), django-autoconfig (>=0.3.4, <=0.3.6) potentially affected by CVE-2024-45231 via django (1.9.0rc2)

django PYPI version 1.9.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-amazon-price-monitor =0.3.0b2, =0.3.4, =0.3.6 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

Malicious code in amazon-data (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in amazon-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7110 Malicious code in amazon-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7111 Malicious code in amazon-data (npm)

--- -= Per source details. Do not edit below this line.=-...

addpage (0.2.0), amazon-textract-helper (>=0.0.2, <=0.0.30) +87 more potentially affected by CVE-2023-36810 via pypdf2 (>=1.24.0, <=1.27.5)

pypdf2 PYPI version =1.24.0, =0.0.2, =0.0.1, =0.0.2, =0.0.1, =0.1.1, =0.2.0, =0.1.0, =0.0.1, =1.1.0, =0.9.0, =1.0.0, =0.0.6, =0.0.59 and more Source cves: CVE-2023-36810 Source advisory: OSV:PYSEC-2026-1837...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2023-259...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2023-25956 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2023-25956 Source advisory: OSV:PYSEC-2026-771...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2023-25956 Source advisory: OSV:PYSEC-2026-771...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2023-25956 Source advisory: OSV:PYSEC-2026-771...

airflow-providers (>=0.1.0, <=0.3.0) potentially affected by CVE-2023-25956 via apache-airflow-providers-amazon (5.1.0)

apache-airflow-providers-amazon PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-providers =0.1.0, =0.3.0 Source cves: CVE-2023-25956 Source advisory: OSV:PYSEC-2026-771...

PYSEC-2026-768 Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path CVE-2026-53366...

Medium: opensc

Issue Overview: A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The...

Important: expat

Issue Overview: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. CVE-2026-56132 Affected Packages: expat Issue Correction: Run dnf update expat...

Important: expat

Issue Overview: libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse. CVE-2026-56406 libexpat before 2.8.2 has an integer overflow in doProlog that is relat...