jhub-shibboleth-auth (1.0.0) potentially affected by CVE-2026-33709 via jupyterhub (0.8.1)

jupyterhub PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.0.0 Source cves: CVE-2026-33709 Source advisory: OSV:GHSA-3VFF-HJQV-M7H8...

jhub-shibboleth-auth (1.4.0) potentially affected by CVE-2026-33709 via jupyterhub (0.9.4)

jupyterhub PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.4.0 Source cves: CVE-2026-33709 Source advisory: OSV:GHSA-3VFF-HJQV-M7H8...

jhub-shibboleth-auth (1.3.0) potentially affected by CVE-2026-33709 via jupyterhub (0.9.2)

jupyterhub PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.3.0 Source cves: CVE-2026-33709 Source advisory: OSV:GHSA-3VFF-HJQV-M7H8...

jhub-shibboleth-auth (1.1.0) potentially affected by CVE-2026-33709 via jupyterhub (0.9.0)

jupyterhub PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.1.0 Source cves: CVE-2026-33709 Source advisory: OSV:GHSA-3VFF-HJQV-M7H8...

EUVD-2026-18790

In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svcexportput calls pathput and authdomainput immediately when the last reference drops, before the RCU grace period. RCU readers in eshow and cshow access both expath via...

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/ are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled MLFLOWSERVERENABLEJOBEXECUTION=true and any j...

Use of GET Request Method With Sensitive Query Strings

Overview @immich/sdk is an Auto-generated TypeScript SDK for the Immich API Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the transmission of authentication credentials in the password parameter within the HTTP request query string...

UBUNTU-CVE-2026-31404

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-31404

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-31404

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-31404

CVE-2026-31404 is rejected and not an active vulnerability entry.

Authorization bypass on all trace endpoints when auth is enabled

Description When MLflow runs with auth enabled, the trace API endpoints don't have authorization validators registered. The beforerequest handler checks each request against BEFOREREQUESTHANDLERS — experiments, runs, models all have entries there, but traces have zero entries. When no validator i...

@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +72 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.4.8-beta.4)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-15876756...

Authentication Bypass Using an Alternate Path or Channel

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the session.cookieCache component. An attacker can gain unauthorized access to protected...

@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +72 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.4.8-beta.4)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: unknown CVE Source advisory: GHSA-XG6X-H9C9-2M83...

@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +72 more potentially affected by CVE-2026-67337 via better-auth (>=1.0.0-canary.2, <=1.4.8-beta.4)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: CVE-2026-67337 Source advisory: OSV:GHSA-XG6X-H9C9-2M83...

CVE-2026-35537

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data...

GHSA-F693-58PC-2GFR OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

Summary Telegram legacy allowFrom migration fans default-account trust into all named accounts Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an...

CVE-2026-0545: Missing Authentication for Critical Function

In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/ are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled MLFLOWSERVERENABLEJOBEXECUTION=true and any j...

PT-2026-32295

Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable...