appcensus-dynamic-repos (0.6.1.91), poetry-grpc-plugin (0.1.5) +5 more potentially affected by CVE-2026-41140 via poetry (1.3.2)

poetry PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - appcensus-dynamic-repos 0.6.1.91 - poetry-grpc-plugin 0.1.5 - poetry-plugin-export 1.2.0 - poetry-plugin-pypi-mirror 0.3.0 -...

pab (>=2.5.5, <=2.8.1), poetry-alias (0.1.0) +2 more potentially affected by CVE-2026-41140 via poetry (1.2.0b3)

poetry PYPI version 1.2.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - pab =2.5.5, =2.8.1 - poetry-alias 0.1.0 - poetry-plugin-export 1.0.5 - poetry-scaffold-plugin 0.1.0 Source cves: CVE-2026-41140 Source advisory:...

poetry-plugin-export (1.0.6) potentially affected by CVE-2026-41140 via poetry (1.2.0)

poetry PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - poetry-plugin-export 1.0.6 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

poetry-plugin-export (>=1.0.7, <=1.1.1), poetry-plugin-tweak-dependencies-version (0.1.0) potentially affected by CVE-2026-41140 via poetry (1.2.1)

poetry PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - poetry-plugin-export =1.0.7, =1.1.1 - poetry-plugin-tweak-dependencies-version 0.1.0 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-289...

Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory

Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory AD enumeration. "The script looked for the Domain Controller DC and mapped users, computers, and domains, before creating a directory and exporting ou...

CVE-2026-14846

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the...

CVE-2026-14846

CVE-2026-14846 affects PrestaShop version 8.2.1. The flaw arises from incorrect sanitisation due to inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This allows an attacker to inject malicious expressions that are executed when exporting data with the ‘Get my ...

CVE-2026-14846 Incorrect neutralisation in the PrestaShop firmware

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the...

EUVD-2026-43335

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the...

CVE-2026-14846 Incorrect neutralisation in the PrestaShop firmware

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the...

PT-2026-58952

Description The normal download your data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Technical description This private export flow turns an authenticated,...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-58489: Cross-Site Request Forgery (CSRF)

HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value but only checked that it was present rather than validating it against the value expected for the user's session. Because the state was not...

CVE-2026-14846: Improper Neutralization of Formula Elements in a CSV File

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the...

PT-2026-57920

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.11.0 Description The GitHub Gist export flow fails to properly validate the OAuth2 state value, checking only for its presence instead of verifying it against the user session. This allows an attacker to forge a...

PT-2026-59366

Summary Blind server side request forgery SSRF via the PDF generate function. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Ope...

PT-2026-60037

Description Impact wireshark-mcp exposes a wireshark export objects MCP tool that accepts an attacker-controlled dest dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox allowed dirs is None by default and only activates when the...

PT-2026-59507

OS command injection CWE-78 vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql copy metacommand template without sanitization. An authenticated user could inject " TO PROGRAM 'cmd'" to break out of the copy ... context and achieve...

CakePHP 5.3.7 Released

CakePHP 5.3.7 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.5. This is a maintenance release for the 5.3 branch that fixes community reported issues and three security issues. Advisories will be published for the issues over the next week as...

PT-2026-57668

Name of the Vulnerable Software and Affected Versions PrestaShop version 8.2.1 Description Incorrect sanitization of elements occurs due to inadequate validation of the Alias parameter within the 'Update your address' function. This allows an attacker to inject malicious expressions that are...