authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-28490 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

GHSA-7432-952R-CW78 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Executive Summary A cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registers RSA15 in its default algorithm registry without requiring explicit opt-in,...

CVE-2026-4230

A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function updatesql of the file src/vanna/legacy/flask/init.py of the component Endpoint. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and ma...

casbin-couchbase-adapter (>=0.1.3, <=0.1.4), fastapi-authz (0.0.3) +1 more potentially affected by CVE-2026-32640 via simpleeval (0.9.10)

simpleeval PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on simpleeval and may be impacted: - casbin-couchbase-adapter =0.1.3, =2.0.0, =2.4.0 Source cves: CVE-2026-32640 Source advisory: OSV:PYSEC-2026-132...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:PYSEC-2026-132...

CVE-2026-4230 vanna-ai vanna Endpoint __init__.py update_sql sql injection

A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function updatesql of the file src/vanna/legacy/flask/init.py of the component Endpoint. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and ma...

CVE-2026-4230

A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function updatesql of the file src/vanna/legacy/flask/init.py of the component Endpoint. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and ma...

Vanna code issue vulnerabilities

Vanna is a personalized AI SQL proxy from Vanna Inc. Versions of Vanna 2.0.2 and earlier contained a code vulnerability. This vulnerability stemmed from improper handling of the updatesql/runsql functions in the file src/vanna/legacy/flask/init.py of the component Endpoint. It could lead to...

PT-2026-25660

Name of the Vulnerable Software and Affected Versions vanna-ai vanna versions up to 2.0.2 Description A flaw exists in the update sql/run sql function within the src/vanna/legacy/flask/ init .py file of the Endpoint component. This issue allows for server-side request forgery when a manipulation ...

Vanna SQL Injection Vulnerability

Vanna is a personalized AI SQL proxy from Vanna Corporation. Versions of Vanna 2.0.2 and earlier had a SQL injection vulnerability. This vulnerability stemmed from improper handling of the updatesql function in the src/vanna/legacy/flask/init.py file of the component endpoint, which could lead to...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: GHSA-44VG-5WV2-H2HG...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: SNYK:PYTHON-SIMPLEEVAL-15610288...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...

casbin-couchbase-adapter (>=0.1.3, <=0.1.4), fastapi-authz (0.0.3) +1 more potentially affected by CVE-2026-32640 via simpleeval (0.9.10)

simpleeval PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on simpleeval and may be impacted: - casbin-couchbase-adapter =0.1.3, =2.0.0, =2.4.0 Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...

EUVD-2026-11484

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function rendertemplate of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...

CVE-2026-3962 Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function rendertemplate of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...

CVE-2026-3962

The CVE-2026-3962 entry affects Jcharis Machine-Learning-Web-Apps (up to a6996b634d98ccec4701ac8934016e8175b60eb5) where the render_template function in Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py under the Jinja2 Template Handler is vulnerable to cross-site...

openSUSE Security Advisory (SUSE-SU-2026:0849-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-24891

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function render template of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Flask (SUSE-SU-2026:0849-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0849-1 advisory. This update for python-Flask fixes the following issue: - CVE-2026-27205: information disclosure due to...