ANT-2026-S8PHCV74 · cloudfoundry/uaa · auth_bypass

auth-bypass medium Severity Claude high · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-S8PHCV74: DenyAccessToUaaAdvice case-sensitive check bypassed on MySQL: zones.write overwrites syste...

Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost

Microsoft has launched its first cybersecurity-specific model inside MDASH , its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its curre...

constellaration (>=0.2.0, <=0.3.0), llm-foundry (0.20.0) +1 more potentially affected by CVE-2026-66007 via datasets (3.5.1)

datasets PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - constellaration =0.2.0, =3.1.0, =3.1.1 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...

blockshark

🦈 BlockShark Autonomous exploit-proving engine for smart co...

automatedcleaning (>=0.1.2, <=1.4.0), dataset-foundry (>=0.2.0, <=0.5.0) +2 more potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.10)

langchain-anthropic PYPI version 0.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - automatedcleaning =0.1.2, =0.2.0, =0.0.22, =0.0.25 - pyseoanalyzer 2025.4.3 Source cves: CVE-2026-55443 Source advisory:...

argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2026-3198 via mlflow (2.17.2)

mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-2659...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-3198 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-265...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-3198 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-2659...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-3198 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-2659...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-3198 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-3198 Source advisory: OSV:PYSEC-2026-2659...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-2734 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2026-2734 via mlflow (2.17.2)

mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-2734 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-2734 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-4137 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

llm-foundry (0.11.0), modeva (>=1.0.14, <=2.1.0) potentially affected by CVE-2026-4137 via mlflow (2.15.1)

mlflow PYPI version 2.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry 0.11.0 - modeva =1.0.14, =2.1.0 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-4137 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-265...

argosml (>=0.0.1, <=0.1.3), bbj-argos (0.0.1) +6 more potentially affected by CVE-2026-4137 via mlflow (2.17.2)

mlflow PYPI version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - argosml =0.0.1, =2.1.3, =0.1.50.4, =0.1.6, =0.1.9.post2 - wedata-pre-code 2.0.2 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2026-4137 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...