docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2024-45231 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

docker-compose-control-center (3.1.0) potentially affected by CVE-2024-45231 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

chaste-codegen (>=0.4.0, <=0.10.2), docker-tidy (>=0.1.0, <=0.1.4) +6 more potentially affected by CVE-2024-5569 via zipp (1.2.0)

zipp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - chaste-codegen =0.4.0, =0.1.0, =0.7.10, =1.18.3, =26.0.0, =1.0.4, =1.0.6 - mapyllary 0.0.6 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-20...

PYSEC-2026-2068 Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

PYSEC-2026-2069 zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7349 Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

OPENSUSE-SU-2026:21247-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

SUSE-SU-2026:22567-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-49487 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-49487 Source advisory: OSV:GHSA-22HF-VX2V-GJFF...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-48892 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-48892 Source advisory: OSV:GHSA-9933-5RRP-MFWX...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-48828 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-48828 Source advisory: OSV:GHSA-563F-2439-RMQ4...

SUSE-SU-2026:22703-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

Docassemble open redirect

ImpactIt is possible to create a URL that acts as an open redirect. PatchesThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. WorkaroundsIf upgrading is not possible, manually apply the changes of 4801ac7 and restart the serv...

PYSEC-2026-1310 Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...

PYSEC-2026-1311 Docassemble HTML and javascript injection

Impact A user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags allowing JavaScript to execute on the page. Patches The vulnerability has been patched in version 1.4.97 of the master...

PYSEC-2026-2003 vantage6 has insecure SSH configuration for node and server containers

Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...

PYSEC-2026-1312 DockerSpawner allows any image by default

Impact Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. Patches Upgrade to DockerSpawner 13...

DockerSpawner allows any image by default

ImpactUsers of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. PatchesUpgrade to DockerSpawner 13...