diacamma-asso (>=2.0.1.16012810, <=2.1.16.17102513), diacamma-financial (>=2.0.1.16012810, <=2.1.15.17102513) +5 more potentially affected by CVE-2023-4863 +1 more via pillow (2.8.0)

pillow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - diacamma-asso =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.15101417, =2.0.1.15101417, =2.0.1.15101417, =0.1.2.1, =0.1.3 Source cves:...

PyPDF2 quadratic runtime with malformed PDF missing xref marker

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. Patcheshttps://github.com/py-pdf/pypdf/pull/808 WorkaroundsIs...

Reportlab vulnerable to remote code execution

Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file...

PYSEC-2026-1871 Reportlab vulnerable to remote code execution

Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file...

CVE-2026-57869

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3...

CVE-2026-57869

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3...

CVE-2026-57869

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3...

CVE-2026-57869

CVE-2026-57869 affects MicroRealEstate up to version 1.0.0-alpha3. The vulnerability stems from broken object-level access controls and a deterministic pattern used in random ID generation, enabling attackers to access documents uploaded by landlords or tenants without authorization. The availabl...

Exploit for Improper Neutralization of Special Elements in Data Query Logic in Budibase

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injec...

CVE-2026-23697: Unrestricted Upload of File with Dangerous Type

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

PT-2026-56207

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

PT-2026-56154

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3...

diacamma-asso (>=2.0.1.16012810, <=2.1.16.17102513), diacamma-financial (>=2.0.1.16012810, <=2.1.15.17102513) +5 more potentially affected by CVE-2026-55380 via pillow (2.8.0)

pillow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - diacamma-asso =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.15101417, =2.0.1.15101417, =2.0.1.15101417, =0.1.2.1, =0.1.3 Source cves:...

diacamma-asso (>=2.0.1.16012810, <=2.1.16.17102513), diacamma-financial (>=2.0.1.16012810, <=2.1.15.17102513) +5 more potentially affected by CVE-2026-55379 via pillow (2.8.0)

pillow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - diacamma-asso =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.15101417, =2.0.1.15101417, =2.0.1.15101417, =0.1.2.1, =0.1.3 Source cves:...

Maestro 0.17.3

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

Missing Authentication for Critical Function

Overview mcp-memory-service is an Open-source persistent memory for AI agent pipelines and Claude. REST API + semantic search + knowledge graph + autonomous consolidation. Self-host, zero cloud cost. Affected versions of this package are vulnerable to Missing Authentication for Critical Function ...

GHSA-84HP-MQVJ-3P8H mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete Summary All HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An...

PYSEC-2026-760 Zope DocumentTemplate package allows unauthenticated write

The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization...

CVE-2026-9563

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memo...

CVE-2026-9563

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memo...