autotrader (>=0.12.0, <=0.12.1), biosmoother (>=0.3.3, <=1.6.1) +2 more potentially affected by CVE-2026-21883 via bokeh (2.3.2)

bokeh PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - autotrader =0.12.0, =0.3.3, =1.0.1b2, =1.0.8 - futon 1.0.0 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1223...

umap-project (0.8.3) potentially affected by CVE-2025-61783 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

rest-social-auth (>=1.3.0, <=1.4.0), saltdash (>=0.9.1, <=0.9.5) +1 more potentially affected by CVE-2025-61783 via social-auth-app-django (2.1.0)

social-auth-app-django PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - rest-social-auth =1.3.0, =0.9.1, =1.0.0rc1, =1.0.0rc8 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-19...

pixelcms-server (>=0.4.1, <=0.4.2), pixelcms-shop-server (0.0.1) +1 more potentially affected by CVE-2025-61783 via social-auth-app-django (0.1.0)

social-auth-app-django PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - pixelcms-server =0.4.1, =1.0.0, =1.1.0 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2025-61783 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

edx-auth-backends (>=1.0.1, <=2.0.2), rest-social-auth (1.2.0) potentially affected by CVE-2025-61783 via social-auth-app-django (1.2.0)

social-auth-app-django PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - edx-auth-backends =1.0.1, =2.0.2 - rest-social-auth 1.2.0 Source cves: CVE-2025-61783 Source advisory:...

django-auth0-user (>=0.15.0, <=0.16.5), edx-auth-backends (>=3.0.0, <=3.0.2) +4 more potentially affected by CVE-2025-61783 via social-auth-app-django (3.4.0)

social-auth-app-django PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =0.1.0, =4.4.0a1, =0.2.0, =2.0.0, =5.0.1 Source cves: CVE-2025-61783 Source...

django-globus-portal-framework (>=0.3.23, <=0.4.2), django-user-app (0.0.6) +14 more potentially affected by CVE-2025-61783 via social-auth-app-django (4.0.0)

social-auth-app-django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-globus-portal-framework =0.3.23, =2.28.1, =1.3.0, =1.0.0b3, =1.6.0, =0.9.2.dev0, =0.9.0, =0.1.0, =6.0.0,...

argus-notification-msteams (0.5.1), argus-server (>=1.0.0, <=1.22.1) +97 more potentially affected by CVE-2025-61783 via social-auth-app-django (>=5.0.0, <=5.4.3)

social-auth-app-django PYPI version =5.0.0, =1.0.0, =1.0.0, =4.14.0, =0.4.3, =0.8.7, =0.0.2a17, =1.0.0, =1.0.0, =2026.6.0, =1.2.0, =4.8.0, =0.0.2, =0.0.16 and more Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

cnili-authentication (0.0.1), django-rest-social-email-allauth (0.1.0) +5 more potentially affected by CVE-2025-61783 via social-auth-app-django (3.1.0)

social-auth-app-django PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - cnili-authentication 0.0.1 - django-rest-social-email-allauth 0.1.0 - libraryapp =3.0.8, =2.0.0b9, =0.9.6, =1.0.0rc9...

Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

ImpactWhen Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create J...

PYSEC-2026-1967 TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

Description A critical path traversal vulnerability CWE-22 has been identified in the reviewpaper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. Impact...

TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

DescriptionA critical path traversal vulnerability CWE-22 has been identified in the reviewpaper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions...

Gradio CORS Origin Validation Bypass Vulnerability

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function isvalidorigin of the component CORS Handler. The manipulation of the argument localhostaliases leads to origin validation error. It is possible to initiate the attack remotely. Th...

PYSEC-2026-1423 Gradio CORS Origin Validation Bypass Vulnerability

A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function isvalidorigin of the component CORS Handler. The manipulation of the argument localhostaliases leads to origin validation error. It is possible to initiate the attack remotely. Th...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-48588 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

GO-2026-5869 Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher

Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5909 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder...

cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-8966 via gradio (1.7.7)

gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...