GHSA-8F6J-263M-G72X Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

Summary SignedDataVerifier attempts to perform online revocation checking when enableonlinechecks=True, but its OCSP validation logic accepts stale GOOD responses as valid indefinitely. In appstoreserverlibrary/signeddataverifier.py, ChainVerifier.checkocspstatus verifies the OCSP response...

CVE-2026-62197

creationtimestamp| type| source ---|---|--- 2026-07-13 22:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkricfkio2z...

CVE-2026-62184

CVE-2026-62184 affects the OpenWrt luci-app-banip component. The issue is a log-parsing vulnerability in an awk-based parser that always extracts the first IPv4 address from a log line, regardless of its actual field position. An unauthenticated remote attacker can inject an IP address via attack...

CVE-2026-62184 luci-app-banip Log Monitor IP Extraction Bypass

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

CVE-2026-62184 luci-app-banip Log Monitor IP Extraction Bypass

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

EUVD-2026-43558

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector...

GHSA-4W3Q-QPFQ-V992 Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in...

ai-parrot (>=0.5.0, <=0.5.16), aleksis-app-order (>=0.1.1, <=0.7.0.dev0) +11 more potentially affected by CVE-2026-49452 via weasyprint (61.2.0)

weasyprint PYPI version 61.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.5.0, =0.1.1, =1.0.0, =0.1.1, =3.3.0, =0.9.8, =21.9.1, =1.0.1, =3.12.27, =2.8.0, =2.10.1 - xblock-ai-eval 0.3.3 Source cves:...

amusing-app (>=0.1.0, <=0.1.2), mamkit (>=0.1.0, <=1.0.1) +3 more potentially affected by CVE-2026-50574 via yt-dlp (2023.11.16)

yt-dlp PYPI version 2023.11.16 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.1.0, =0.1.0, =1.3.2, =0.0.1, =2023.11.16, =2024.1.5.post4 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

amusing-app (>=0.2.0, <=0.4.2), music-tool-kit (>=1.3.9, <=1.3.21) +6 more potentially affected by CVE-2026-50023 via yt-dlp (2024.4.9)

yt-dlp PYPI version 2024.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.2.0, =1.3.9, =0.2.0, =0.0.5, =2024.4.26.post1, =2024.5.11 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

amusing-app (>=0.1.0, <=0.1.2), mamkit (>=0.1.0, <=1.0.1) +3 more potentially affected by CVE-2026-50023 via yt-dlp (2023.11.16)

yt-dlp PYPI version 2023.11.16 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.1.0, =0.1.0, =1.3.2, =0.0.1, =2023.11.16, =2024.1.5.post4 Source cves: CVE-2026-50023 Source advisory: OSV:PYSEC-2026-3430...

amusing-app (>=0.2.0, <=0.4.2), music-tool-kit (>=1.3.9, <=1.3.21) +6 more potentially affected by CVE-2026-50574 via yt-dlp (2024.4.9)

yt-dlp PYPI version 2024.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.2.0, =1.3.9, =0.2.0, =0.0.5, =2024.4.26.post1, =2024.5.11 Source cves: CVE-2026-50574 Source advisory: OSV:PYSEC-2026-3433...

bugbug (>=0.0.590, <=0.0.593), ws-bom-robot-app (>=0.0.86, <=0.0.92) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.19)

langchain-anthropic PYPI version 0.3.19 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - bugbug =0.0.590, =0.0.86, =0.0.92 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2556...

app-use (>=0.0.1, <=0.0.3), py-agent-search (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.14)

langchain-anthropic PYPI version 0.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - app-use =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2556...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-5422 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-5422 Source advisory: OSV:PYSEC-2026-2532...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +15 more potentially affected by CVE-2026-6606 via agentscope (>=1.0.5, <=1.0.18)

agentscope PYPI version =1.0.5, =1.0.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0.post1, =1.1.0a1, =1.0.2, =0.1.7, =0.0.0.1, =1.0.0.0, =1.0.0.2 and more Source cves: CVE-2026-6606 Source advisory: OSV:PYSEC-2026-2332...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +15 more potentially affected by CVE-2026-6605 via agentscope (>=1.0.5, <=1.0.18)

agentscope PYPI version =1.0.5, =1.0.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0.post1, =1.1.0a1, =1.0.2, =0.1.7, =0.0.0.1, =1.0.0.0, =1.0.0.2 and more Source cves: CVE-2026-6605 Source advisory: OSV:PYSEC-2026-2330...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2026-41314 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...