Salt's worker process vulnerable to denial of service through file read operation

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...

PYSEC-2026-1897 Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

Salt vulnerable to directory traversal attack in minion file cache creation

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory...

PYSEC-2026-1901 Salt vulnerable to directory traversal attack in minion file cache creation

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory...

apollo-sdk (>=0.1.1, <=0.1.6), bell-nozzle-master (1.0.8) +5 more potentially affected by CVE-2026-48588 via django (4.1.2)

django PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.1.1, =3.11.6, =0.61.0, =0.62.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the checksdpcrypto function due to an inverted boolean condition. An attacker can weaken the binding between DTLS certificates and SDP by intercepting and modifying WebRTC signaling...

Python package "zhmcclient" stores passwords in clear text in its HMC and API logs

ImpactThe Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs The 'ssc-master-pw' an...

Path traversal in saltstack

A specially crafted url can be created which leads to a directory traversal in the salt file server.A malicious user can read an arbitrary file from a Salt master’s filesystem...

Directory creation by malicious user in saltstack

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can leada malicious attacker to create an arbitrary directory on a Salt master...

PYSEC-2026-1900 Directory creation by malicious user in saltstack

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master...

PYSEC-2026-1891 Path traversal in saltstack

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem...

PYSEC-2026-1310 Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...

email-master (0.6.2), hnzhu010506 (0.0.1) +2 more potentially affected by CVE-2023-50782 via cryptography (37.0.0)

cryptography PYPI version 37.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - email-master 0.6.2 - hnzhu010506 0.0.1 - hnzhu010507 =0.0.1, =0.0.8 - kadi 0.24.0 Source cves: CVE-2023-50782 Source advisory:...

email-master (0.6.2), hnzhu010506 (0.0.1) +2 more potentially affected by CVE-2024-0727 via cryptography (37.0.0)

cryptography PYPI version 37.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - email-master 0.6.2 - hnzhu010506 0.0.1 - hnzhu010507 =0.0.1, =0.0.8 - kadi 0.24.0 Source cves: CVE-2024-0727 Source advisory:...

EUVD-2026-42035

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107...

CVE-2026-11348 Authentication Bypass in HAVELSAN's Open Source Project Liman MYS

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...

PYSEC-2026-838 OpenStack Kolla sudo privilege escalation vulnerability

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges...

PT-2026-56183

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affects Liman MYS: before release.Master.1107...

Open Redirect

Overview kiwitcms is a Test Case Management System Affected versions of this package are vulnerable to Open Redirect via the next parameter in the account confirmation endpoint. An attacker can redirect users to arbitrary external domains by crafting a malicious URL, potentially facilitating...