38116 matches found
GHSA-H35F-9H28-MQ5C vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, superset, mlflow, pypy-3.10, httpie, kubeflow-volumes-web-app, py3-pipenv, airflow, datadog-agent, kubeflow-katib, py3-setuptools...
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-61000
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrraokts2b 2026-07-23 17:50:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-47054
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
plone.app.textfield: Stored XSS by spoofing mime type
ImpactA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...
PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
ImpactThe FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website ...
PYSEC-2026-3465 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...
PYSEC-2026-3518 PraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...
PraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI Slack appmention bypasses configured user/channel authorization SummaryPraisonAI's Slack bot applies its configured allowedusers,allowedchannels, and unknown-user pairing policy in the normal Slackmessage event handler, but not in the adjacent Slack appmention eventhandler.A Slack...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server
Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules
Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes (CVE-2026-12947)
Summary IBM App Connect Enterprise Discovery Connector nodes users are vulnerable to Confidentiality disclosure on Discovery Connector nodes. Vulnerability Details CVEID:CVE-2026-12947 DESCRIPTION: IBM App Connect Enterprise stores potentially sensitive information in log files that could be read...
CVE-2026-59885 vulnerabilities
Vulnerabilities for packages: litellm, superset, openstack-keystone-2025.1, kubeflow-jupyter-web-app, datadog-agent-fips, openstack-keystone-2026.1, k8s-sidecar, datahub-ingestion-fips, request-1276, mlflow, kubeflow, datahub-ingestion, lmcache-cuda-12.8, py3-cassandra-medusa,...
GHSA-8PPF-4F7H-5PPJ vulnerabilities
Vulnerabilities for packages: litellm, superset, openstack-keystone-2025.1, kubeflow-jupyter-web-app, datadog-agent-fips, openstack-keystone-2026.1, k8s-sidecar, datahub-ingestion-fips, request-1276, mlflow, kubeflow, datahub-ingestion, lmcache-cuda-12.8, py3-cassandra-medusa,...
CVE-2026-59886 vulnerabilities
Vulnerabilities for packages: litellm, superset, openstack-keystone-2025.1, kubeflow-jupyter-web-app, datadog-agent-fips, openstack-keystone-2026.1, k8s-sidecar, datahub-ingestion-fips, request-1276, mlflow, kubeflow, datahub-ingestion, lmcache-cuda-12.8, py3-cassandra-medusa,...
CVE-2026-59890 vulnerabilities
Vulnerabilities for packages: text-generation-inference, pgadmin4, openstack-glance-2026.1-fips, openstack-placement-2025.2, tritonserver-backend-vllm-cuda-13.0, superset, ansible-operator, openstack-placement-2026.1, mlflow-fips, openstack-keystone-2025.1, kubeflow-jupyter-web-app,...
GHSA-H35F-9H28-MQ5C vulnerabilities
Vulnerabilities for packages: text-generation-inference, pgadmin4, openstack-glance-2026.1-fips, openstack-placement-2025.2, tritonserver-backend-vllm-cuda-13.0, superset, ansible-operator, openstack-placement-2026.1, mlflow-fips, openstack-keystone-2025.1, kubeflow-jupyter-web-app,...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)
Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html. Vulnerability Details CVEID:CVE-2026-53606...
