160344 matches found
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-4137 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-2614 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-2614 Source advisory: OSV:PYSEC-2026-2654...
PYSEC-2026-2386 auto-favicon has a Server-Side Request Forgery issue
A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generatefaviconfromurl of the file src/autofavicon/server.py of the component MCP Tool. The manipulation of the argument imageurl results in server-side request forgery...
auto-favicon has a Server-Side Request Forgery issue
A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generatefaviconfromurl of the file src/autofavicon/server.py of the component MCP Tool. The manipulation of the argument imageurl results in server-side request forgery...
PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
SummaryThe gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, an attacker can cause the ExecApprovalManager to...
PYSEC-2026-2901 PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
Summary The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, an attacker can cause the ExecApprovalManager to...
PYSEC-2026-2516 Home Assistant has stored XSS in history-graphs
Summary The "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable to the same issue as CVE-2025-62172. This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue. Details Another...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-15031 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-14287 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-14287 Source advisory: OSV:PYSEC-2026-2661...
auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-2033 via mlflow (2.20.3)
mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-2033 Source advisory: OSV:PYSEC-2026-2658...
CVE-2026-61970
Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...
CVE-2026-61970
Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...
EUVD-2026-43439
Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...
CVE-2026-61970
The CVE-2026-61970 entry concerns a Server-Side Request Forgery (SSRF) in the Themeisle Auto Featured Image (Auto Post Thumbnail) WordPress plugin. Affected versions are <= 5.0.4 (reported as from n/a through
CVE-2026-61970 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...
CVE-2026-61970 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in Themeisle Auto Featured Image Auto Post Thumbnail auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image Auto Post Thumbnail: from n/a through = 5.0.4...
Malicious Package
Overview auto-debug-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-12273
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments...
MAL-2026-10256 Malicious code in abuden213 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a014a046e0516c12f5b1d7dcebebc2451633c4987fd3c96aae43229501ede141 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10263 Malicious code in abuden222 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c141ada78ccdede0bb49a76d998fcf07eb4cc60c58cce5fdc1b5933b85a817d The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...