brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2026-49855 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2026-49855 Source advisory: OSV:PYSEC-2026-3389...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2026-49853 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2026-49853 Source advisory: OSV:PYSEC-2026-3387...

PYSEC-2026-2866 pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules

Stored cross-site scripting XSS vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names database, schema, table, column, etc. were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute...

pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules

Stored cross-site scripting XSS vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.User-controlled PostgreSQL object names database, schema, table, column, etc. were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2026-1462 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2026-1462 Source advisory:...

span-explain (0.1.0) potentially affected by CVE-2026-26013 via langchain-core (0.1.15)

langchain-core PYPI version 0.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - span-explain 0.1.0 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

PT-2026-59503

Stored cross-site scripting XSS vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names database, schema, table, column, etc. were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2025-47287 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2025-47287 Source advisory: OSV:PYSEC-2026-1974...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2026-12481 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2026-12481 Source advisory:...

pgAdmin 4 Plugin Arbitrary JavaScript Execution

The vulnerability of the Browser Tree and the Explain Visualizer modules in the pgAdmin 4 database management tool exists due to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2026-12480 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2026-12480 Source advisory:...

agentlite-llm (0.1.12), code-rl (>=0.0.7, <=0.0.9) +2 more potentially affected by CVE-2026-55443 via langchain (0.1.3)

langchain PYPI version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - agentlite-llm 0.1.12 - code-rl =0.0.7, =0.0.9 - span-explain 0.1.0 - zigent 0.0.1 Source cves: CVE-2026-55443 Source advisory:...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2026-12479 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2026-12479 Source advisory:...

CVE-2026-12048

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields was passed...

CVE-2026-12048 pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields was passed...

BIT-DISCOURSE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user with access to the AI...

CVE-2026-44785

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...

CVE-2026-44785

CVE-2026-44785 affects Discourse. The vulnerability arises because the AI "explain" helper validates can_see? only on the post being explained, allowing an authenticated user with access to the AI helper to read the raw contents of a hidden parent post by invoking Explain on a reply to it. Affect...