cloudmesh-client (>=4.5.0, <=4.7.3), nirum (>=0.0.1, <=0.3.8) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.11.15)

werkzeug PYPI version 0.11.15 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - cloudmesh-client =4.5.0, =0.0.1, =0.4.3, =1.0.0, =0.8.0, =0.1.14, =0.1.20 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

PYSEC-2026-1753 ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Summary The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in...

anki-cli-unofficial (1.0.1), orglearn (>=1.1.0, <=1.1.5) potentially affected by CVE-2024-32152 via anki (2.1.44)

anki PYPI version 2.1.44 is affected by a known vulnerability. The following packages have a transitive dependency on anki and may be impacted: - anki-cli-unofficial 1.0.1 - orglearn =1.1.0, =1.1.5 Source cves: CVE-2024-32152 Source advisory: OSV:PYSEC-2026-1117...

anki-cli-unofficial (1.0.1), orglearn (>=1.1.0, <=1.1.5) potentially affected by CVE-2024-26020 via anki (2.1.44)

anki PYPI version 2.1.44 is affected by a known vulnerability. The following packages have a transitive dependency on anki and may be impacted: - anki-cli-unofficial 1.0.1 - orglearn =1.1.0, =1.1.5 Source cves: CVE-2024-26020 Source advisory: OSV:PYSEC-2026-1116...

yeedu-cli (>=4.11.0, <=4.13.0) potentially affected by CVE-2024-6345 via setuptools (64.0.0)

setuptools PYPI version 64.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - yeedu-cli =4.11.0, =4.13.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

vast-cli-fork (>=1.11.72, <=1.11.74) potentially affected by CVE-2024-6345 via setuptools (51.1.1)

setuptools PYPI version 51.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - vast-cli-fork =1.11.72, =1.11.74 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

goyabu-cli (>=1.0.7, <=1.0.15) potentially affected by CVE-2024-6345 via setuptools (64.0.1)

setuptools PYPI version 64.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - goyabu-cli =1.0.7, =1.0.15 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

m3-cli (>=3.139.1, <=4.161.0) potentially affected by CVE-2024-6345 via setuptools (68.2.1)

setuptools PYPI version 68.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - m3-cli =3.139.1, =4.161.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

seqslab-cli (>=3.2.1.post0, <=3.2.5) potentially affected by CVE-2024-6345 via setuptools (59.0.1)

setuptools PYPI version 59.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - seqslab-cli =3.2.1.post0, =3.2.5 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

neo-cli (>=0.8.2, <=0.9.3), temp-ssh (0.0.1) potentially affected by CVE-2024-6345 via setuptools (37.0.0)

setuptools PYPI version 37.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - neo-cli =0.8.2, =0.9.3 - temp-ssh 0.0.1 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

aitest-cli (>=0.0.7, <=0.0.9), geonode (4.4.5) potentially affected by CVE-2024-6345 via setuptools (63.0.0)

setuptools PYPI version 63.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aitest-cli =0.0.7, =0.0.9 - geonode 4.4.5 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

SUSE-SU-2026:22566-1 Security update for jq

This update for jq fixes the following issues: - CVE-2025-48060: improper handling of string data in jvstringempty can lead to heap buffer overflow and a crash when processing crafted input bsc1244116. - CVE-2026-32316: integer overflow within the jvpstringappend and jvpstringcopyreplacebad...

Malicious code in shopify-cli-extensions (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8632 Malicious code in shopify-cli-extensions (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in shopify-cli-dependencies (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-8631 Malicious code in shopify-cli-dependencies (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

biweeklybudget (>=0.1.0, <=0.7.0), crossbar (17.3.1) +6 more potentially affected by CVE-2023-50782 via cryptography (1.8.1)

cryptography PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - biweeklybudget =0.1.0, =1.6.0, =1.1.2, =2.2.0, =0.3.4, =0.3.5 - typtop 0.2.11 Source cves: CVE-2023-50782 Source advisory:...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2023-50782 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...

azure-cli (>=2.0.58, <=2.0.66), azure-cli-appservice (>=0.2.13, <=0.2.20) +27 more potentially affected by CVE-2023-50782 via cryptography (2.4.2)

cryptography PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - azure-cli =2.0.58, =0.2.13, =1.5.5, =1.0.0b6, =18.4.0, =0.3.0rc1, =1.0.3, =0.1.0, =1.2.8, =1.0.5, =2.1.12 and more Source cves:...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2024-0727 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...