CLEANSTART-2026-AU42206 filelock is a platform-independent file lock for Python

Security vulnerability affects the litellm-database package. filelock is a platform-independent file lock for Python...

CLEANSTART-2026-XZ00463 filelock is a platform-independent file lock for Python

Security vulnerability affects the litellm-database package. filelock is a platform-independent file lock for Python...

CLEANSTART-2026-OJ63833 Datadog dd-trace-py is the Datadog Python APM client

Security vulnerability affects the litellm-database package. Datadog dd-trace-py is the Datadog Python APM client...

CLEANSTART-2026-WY72270 filelock is a platform-independent file lock for Python

Security vulnerability affects the litellm-database package. filelock is a platform-independent file lock for Python...

CLEANSTART-2026-NT53599 filelock is a platform-independent file lock for Python

Security vulnerability affects the litellm-database package. filelock is a platform-independent file lock for Python...

CLEANSTART-2026-ZN36596 filelock is a platform-independent file lock for Python

Security vulnerability affects the litellm-database package. filelock is a platform-independent file lock for Python...

CLEANSTART-2026-PH08344 Security fix for GHSA-7gcm-g887-7qv7 applied in: litellm-database 1.103.9-r3

Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...

Medium: soci-snapshotter

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

CVE-2026-63399: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

PT-2026-134413

Summary AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has ...

CVE-2026-119554: Moodle Project moodle: Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql…

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sy...

PT-2026-133604

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete gradebook from skill, save profile, and delete profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check token validation. An attacker can use cross-site reque...

PT-2026-133544

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

PT-2026-134414

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

PT-2026-133492

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sy...

GESIS Surf: An Open-Source Infrastructure for Privacy-Preserving Longitudinal Web Browsing Data Collection

Understanding how people navigate digital media environments requires behavioral data beyond survey self-reports. However, existing infrastructures for collecting such data reproducibly, sustainably, and with strong privacy guarantees remain limited: commercial solutions lack transparency and dat...

WordPress Database Cleaner: Cleanup, Optimization & Repair plugin <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion vulnerability

Authenticated Administrator+ Arbitrary Table Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Database Cleaner versions = 1.4.7...

PT-2026-134247

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

CVE-2026-119575: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated…

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...