CVE-2026-33895

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order S = L. A valid signature and its S + L variant...

appguard-runtime (>=0.0.1, <=0.0.2), asknews (>=0.11.18, <=0.13.11) +28 more potentially affected by CVE-2026-34073 via cryptography (45.0.4)

cryptography PYPI version 45.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - appguard-runtime =0.0.1, =0.11.18, =0.1.4, =1.1.51, =0.2.32, =0.0.1b1, =1.14.0, =1.7.0, =1.7.4 - linuxserverstatstelegrambot 1.0.8 and...

ais-dom (>=0.89.2, <=0.91.5), atlassian-jwt-auth (>=4.1.2, <=5.0.1) +38 more potentially affected by CVE-2026-34073 via cryptography (2.5.0)

cryptography PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.89.2, =4.1.2, =5.0.1 - azureml-contrib-brainwave 1.0.17 - azureml-contrib-iot 1.0.17 - azureml-contrib-notebook 1.0.17 -...

askflow-cli (1.0.0), atlassian-jwt-auth (>=8.0.2, <=9.0.0) +68 more potentially affected by CVE-2026-34073 via cryptography (3.2.1)

cryptography PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - askflow-cli 1.0.0 - atlassian-jwt-auth =8.0.2, =0.0.9, =0.2.7a0, =0.0.2, =0.0.1a12, =0.6.0, =3.1.12, =2.1.0, =1.0.0, =0.0.19, =0.7.1,...

atlassian-jwt-auth (8.0.1), authx (>=0.0.3, <=0.0.5) +28 more potentially affected by CVE-2026-34073 via cryptography (3.1.1)

cryptography PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 8.0.1 - authx =0.0.3, =0.9.1, =1.0.0, =0.8.2rc2, =3.20.0, =0.1.0a1, =0.0.1, =0.0.7, =0.0.5, =0.1.0a1, =0.1.0a4 and mo...

atlassian-jwt-auth (>=2.8.1, <=2.10.0), fallixy (0.18.1) +3 more potentially affected by CVE-2026-34073 via cryptography (1.5.3)

cryptography PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.8.1, =0.18.1, =0.9.0, =1.1.0 - teamvault 0.6.0 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV4...

atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2026-34073 via cryptography (1.3.4)

cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-34073 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (>=2.2.0, <=2.4.0) potentially affected by CVE-2026-34073 via cryptography (1.2.1)

cryptography PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.2.0, =2.4.0 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (2.1.1), pyupdater (1.1.8) potentially affected by CVE-2026-34073 via cryptography (1.1.1)

cryptography PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.1.1 - pyupdater 1.1.8 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-34073 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2026-34073 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-31943

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, "isPrivateIP" in "packages/api/src/auth/domain.ts" fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protection and make the server issue HTTP...

GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2025-15381

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2025-15381

Affected software: mlflow/mlflow (deployments using mlflow server --app-name=basic-auth). Vulnerability: When the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators, allowing any authenticated user (including those with NO_PERMISSIONS on the exp...

CVE-2025-15381

In the latest version of mlflow/mlflow, when the "basic-auth" app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with "NOPERMISSIONS" on the experiment, to read trace information and create assessments f...

EUVD-2026-16632

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...

CVE-2026-4984

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...