PYSEC-2026-2617 Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

Summary On Windows, a URI using backslash traversal e.g. ....\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside the configured template directory. Details The root cause is a...

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

SummaryOn Windows, a URI using backslash traversal e.g. \..\..\ secret.txt bypasses the directory traversal check in Template.init and the posixpath-based normalization in TemplateLookup.gettemplate, allowing reads of files outside the configured template directory. DetailsThe root cause is a...

web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

Summaryweb3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination validation:...

PYSEC-2026-3414 web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

Summary web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination validation...

wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

SummaryThree nutritionalvalues action endpoints fetch objects via Model.objects.getpk=pk — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrar...

TensorFlow has Null Pointer Error in TensorArrayConcatV2

ImpactWhen ctx-stepcontainter is a null ptr, the Lookup function will be executed with a null pointer.pythonimport tensorflow as tftf.rawops.TensorArrayConcatV2handle='a', 'b', flowin = 0.1, dtype=tf.int32, elementshapeexcept0=1 PatchesWe have patched the issue in GitHub commit...

TensorFlow has Null Pointer Error in LookupTableImportV2

ImpactThe function tf.rawops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE.pythonimport tensorflow as tfv = [email protected]=Truedef test: func = tf.rawops.LookupTableImportV2 para='tablehandle': v.handle,'keys': 62.98910140991211,...

TensorFlow has Null Pointer Error in LookupTableImportV2

ImpactThe function tf.rawops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE.pythonimport tensorflow as tfv = [email protected]=Truedef test: func = tf.rawops.LookupTableImportV2 para='tablehandle': v.handle,'keys': 62.98910140991211,...

PYSEC-2026-3301 TensorFlow has Null Pointer Error in LookupTableImportV2

Impact The function tf.rawops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. python import tensorflow as tf v = tf.Variable1 @tf.functionjitcompile=True def test: func = tf.rawops.LookupTableImportV2 para='tablehandle': v.handle,'keys': 62.98910140991211,...

USN-8496-3: cifs-utils vulnerability

USN-8496-1 fixed vulnerabilities in cifs-utils. The update caused a regression and was backed out in USN-8496-2. This update reintroduces the security fix, along with a fix for the regression. Original advisory details: It was discovered that cifs-utils incorrectly dropped root privileges before...

PT-2026-59734

Impact When ctx-step containter is a null ptr, the Lookup function will be executed with a null pointer. python import tensorflow as tf tf.raw ops.TensorArrayConcatV2handle='a', 'b', flow in = 0.1, dtype=tf.int32, element shape except0=1 Patches We have patched the issue in GitHub commit...

PT-2026-59897

Impact When ctx-step containter is a null ptr, the Lookup function will be executed with a null pointer. python import tensorflow as tf tf.raw ops.TensorArrayConcatV2handle='a', 'b', flow in = 0.1, dtype=tf.int32, element shape except0=1 Patches We have patched the issue in GitHub commit...

PT-2026-59760

Impact The function tf.raw ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. python import tensorflow as tf v = tf.Variable1 @tf.functionjit compile=True def test: func = tf.raw ops.LookupTableImportV2 para='table handle': v.handle,'keys': 62.98910140991211,...

PT-2026-59084

Description Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view anoth...

PT-2026-59270

Summary On Windows, a URI using backslash traversal e.g. .... secret.txt bypasses the directory traversal check in Template. init and the posixpath-based normalization in TemplateLookup.get template, allowing reads of files outside the configured template directory. Details The root cause is a...

PT-2026-59915

Impact The function tf.raw ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. python import tensorflow as tf v = tf.Variable1 @tf.functionjit compile=True def test: func = tf.raw ops.LookupTableImportV2 para='table handle': v.handle,'keys': 62.98910140991211,...

PT-2026-59692

Impact The ajax lookup endpoint in application.py bypasses the is accessible access control check that all other endpoints enforce. If a developer restricts model access by overriding is accessible, an authenticated user can still query that model's data through the ajax lookup endpoint — silentl...

PT-2026-60025

Summary web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchain lookup payload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination...

BIT-NEXTCLOUD-2021-22912

Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user...

BIT-NEXTCLOUD-2021-22905

Nextcloud Android App com.nextcloud.client before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user...