16990 matches found
lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
PYSEC-2026-1592 lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2026-12948
The CVE-2026-12948 vulnerability affects the web management interfaces of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. It is a stored XSS (CWE-79) that permits a remote, authenticated administrator to inject script into certain system configuration fields; the script can exec...
Improper Removal of Sensitive Information Before Storage or Transfer
Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the Config API when per-key secrets backend overrides are configured via...
GHSA-9933-5RRP-MFWX Apache Airflow exposes secrets backend credentials through the Config API
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
Apache Airflow exposes secrets backend credentials through the Config API
The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...
Malicious code in @spinstorm/typescript-config (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7092 Malicious code in @spinstorm/typescript-config (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7091 Malicious code in @spinstorm/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @spinstorm/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1542 litellm passes untrusted data to `eval` function without sanitization
A remote code execution RCE vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.getsecret method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function...
litellm passes untrusted data to `eval` function without sanitization
A remote code execution RCE vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.getsecret method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function...
nautobot-chatops (>=1.6.0, <=1.7.1), nautobot-chatops-arista-cloudvision (>=1.0.1a0, <=1.3.0) +7 more potentially affected by CVE-2024-34707 via nautobot (>=1.0.3, <=1.5.16)
nautobot PYPI version =1.0.3, =1.6.0, =1.0.1a0, =1.1.0, =0.9.2.dev0, =1.5.0, =0.9.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2024-34707 Source advisory: OSV:PYSEC-2026-1688...
PYSEC-2026-1128 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration The celery provider is the only community provider...
ESPHome vulnerable to Authentication bypass via Cross site request forgery
SummaryAPI endpoints in dashboard component of ESPHome version 2023.12.9 command line installation are vulnerable to Cross-Site Request Forgery CSRF allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files create, edit,...
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
PYSEC-2026-1144 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
ansible-inventory-to-ssh-config (>=0.0.2, <=1.0.0) potentially affected by CVE-2023-5115 via ansible (2.10.5)
ansible PYPI version 2.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ansible-inventory-to-ssh-config =0.0.2, =1.0.0 Source cves: CVE-2023-5115 Source advisory: OSV:PYSEC-2026-1120...