CVE-2026-50529 DataEase: Link Token Leakage Prior to Share Password/Ticket Validation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...

CVE-2026-50529

CVE-2026-50529 affects DataEase prior to version 2.10.24. The /de2api/share/proxyInfo interface incorrectly generates and returns an X-DE-LINK-TOKEN before validating the share password or ticket, enabling unauthenticated attackers who know a protected share UUID to obtain a valid link token for ...

CVE-2026-50529

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...

CVE-2026-50529 DataEase: Link Token Leakage Prior to Share Password/Ticket Validation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid...

CVE-2026-57172 DataEase: Hardcoded JWT Signing Secret in ShareLink

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs,...

CVE-2026-23698

creationtimestamp| type| source ---|---|--- 2026-07-07 19:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3f22eb4o2u 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92380 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92380 2026-07-15 00:00:31+00:00|...

GHSA-FQF6-GXHH-2XHW uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

determinebackupmode in src/uucore/src/lib/features/backupcontrol.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone defaulting to existing/numbered, or $VERSIONCONTROL. Affects cp, install, mv, ln which share th...

CVE-2026-59800

creationtimestamp| type| source ---|---|--- 2026-07-07 19:33:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3dwalhqt22 2026-07-07 20:35:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-g6g7-pvmx-m74p 2026-07-07 20:52:05+00:00| seen|...

CVE-2021-21638

creationtimestamp| type| source ---|---|--- 2026-07-07 18:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3735hw5v24...

CVE-2021-21633

creationtimestamp| type| source ---|---|--- 2026-07-07 17:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq35firqjh25...

CVE-2026-14904

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

CVE-2026-14904 RES Auth.GetUserPrivateKey Arbitrary File Read

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

EUVD-2026-42056

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

CVE-2026-59709

creationtimestamp| type| source ---|---|--- 2026-07-07 16:23:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2zc75tn32b...

CVE-2026-12948

creationtimestamp| type| source ---|---|--- 2026-07-07 16:18:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yzanqva24...

Malicious code in runtimedev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The runtimedev-link bin,...

MAL-2026-6948 Malicious code in runtimedev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The runtimedev-link bin,...

PYSEC-2026-2037 Weblate leaks information via screenshots

Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. Patches https://github.com/WeblateOrg/weblate/pull/17516 References Thanks to Lukas May and Michael Leu...

PYSEC-2026-1932 Python Social Auth - Django has unsafe account association

Impact Upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patche...

PYSEC-2026-1482 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves...