a2grunnerp (>=0.1.0, <=0.1.8), dothttp-req (>=0.0.42a3, <=0.0.42a10) +2 more potentially affected by CVE-2026-76825 via restrictedpython (6.0.0)

restrictedpython PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - a2grunnerp =0.1.0, =0.0.42a3, =2.10.0, =2025.9.5, =2025.12.1 Source cves: CVE-2026-76825 Source advisory: OSV:PYSEC-2026-4161...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2026-77401 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2026-77401 Source advisory: OSV:PYSEC-2026-4022...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2026-77401 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2026-77401 Source advisory: OSV:GHSA-PQ59-9FQ7-M886...

a2grunnerp (>=0.1.0, <=0.1.8), dothttp-req (>=0.0.42a3, <=0.0.42a10) +2 more potentially affected by CVE-2026-76825 via restrictedpython (6.0.0)

restrictedpython PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - a2grunnerp =0.1.0, =0.0.42a3, =2.10.0, =2025.9.5, =2025.12.1 Source cves: CVE-2026-76825 Source advisory: OSV:GHSA-HP3V-5VW7-FX9...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), ethyca-fides (>=2.10.0, <=2.13.0) +2 more potentially affected by CVE-2026-77401 via accesscontrol (>=4.4.0, <=6.0.0)

accesscontrol PYPI version =4.4.0, =2.0.0b4, =2.10.0, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: MEND:CVE-2026-77401...

a2grunnerp (>=0.1.0, <=0.1.8), dothttp-req (>=0.0.42a3, <=0.0.42a10) +2 more potentially affected by CVE-2026-55830 via restrictedpython (6.0.0)

restrictedpython PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - a2grunnerp =0.1.0, =0.0.42a3, =2.10.0, =2025.9.5, =2025.12.1 Source cves: CVE-2026-55830 Source advisory: OSV:PYSEC-2026-3917...

a2grunnerp (>=0.1.0, <=0.1.8), dothttp-req (>=0.0.42a3, <=0.0.42a10) +2 more potentially affected by CVE-2026-55830 via restrictedpython (6.0.0)

restrictedpython PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - a2grunnerp =0.1.0, =0.0.42a3, =2.10.0, =2025.9.5, =2025.12.1 Source cves: CVE-2026-55830 Source advisory: OSV:GHSA-FFG3-P8FM-MJX...

PYSEC-2026-2470 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...

PYSEC-2026-2471 Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

Summary Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletio...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2024-51734 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2024-51734 Source advisory: OSV:PYSEC-2026-2326...

ethyca-fides (>=2.10.0, <=2.13.0) potentially affected by CVE-2023-41050 via accesscontrol (6.0.0)

accesscontrol PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.13.0 Source cves: CVE-2023-41050 Source advisory: OSV:PYSEC-2026-2325...

PT-2026-41138

Name of the Vulnerable Software and Affected Versions Fides versions 2.33.0 through 2.84.4 Description A DOM-based Cross-Site Scripting XSS issue exists in fides.js, the script used to render consent banners. The problem occurs when the fides description variable is overridden via a URL query...

Improper Enforcement of Behavioral Workflow

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow in the privacy request approval process when both subjectidentityverificationrequired and...

atsdk (0.2.1), benchmark-runner (>=1.0.570, <=1.0.578) +10 more potentially affected by CVE-2026-26007 via cryptography (42.0.0)

cryptography PYPI version 42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atsdk 0.2.1 - benchmark-runner =1.0.570, =6.9.0, =0.0.2, =0.1.6, =2.43.2, =2.1.0, =3.22.22, =3.45.4 Source cves: CVE-2026-26007 Source...

Improper Session Invalidation

ethycafides is vulnerable to improper session invalidation. The vulnerability is due to active user sessions not being invalidated after an admin UI password change, which allows an attacker with previously obtained session tokens to maintain unauthorized access even after a password reset...

Improper Authorization

ethycafides is vulnerable to improper authorization. The vulnerability is due to insufficient scope validation in the OAuth client creation and update endpoints, which allows an attacker or a highly privileged user to escalate privileges to owner-level...

Improper Control of Interaction Frequency

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Improper Control of Interaction Frequency due to inefficient built-in IP-based rate limiting in environments with CDNs, proxies or load balancers. An attacker can...

Brute Force

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Brute Force via insufficient protections on the authentication process. An attacker can gain unauthorized access to user accounts by performing automated credential...

Insufficient Session Expiration

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the insufficient session management. The authentication system validates tokens based on their cryptographic integrity and...

Client-Side Enforcement of Server-Side Security

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the /api/v1/user/accept-invite endpoint. An attacker can...