PYSEC-2026-2387 AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parsecontentstream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the...

Virtuozzo Infrastructure 7.4 (7.4.0-66)

This release updates managed Kubernetes to version 1.35.3 and Fedora CoreOS to version 43, introduces API credentials for external automation workflows, and provides the updater patches and tooling required to upgrade the product to version 8.0. It also includes object storage performance...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2026-59890 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

Am I affected? Users are affected if all of these hold: - They install and register the @better-auth/scim plugin plugins: scim. - They create SCIM providers without an organizationId, that is, non-organization "personal" providers. Organization-scoped providers are not affected because they enfor...

GHSA-J8V8-G9CX-5QF4 @better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

Am I affected? Users are affected if all of these hold: - They install and register the @better-auth/scim plugin plugins: scim. - They create SCIM providers without an organizationId, that is, non-organization "personal" providers. Organization-scoped providers are not affected because they enfor...

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

GHSA-P2FR-6HMX-4528 @better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

aviatrix-migration-gcp (>=0.1.1, <=0.3.2), caraml-store (>=0.0.2, <=0.0.8) +9 more potentially affected by CVE-2026-0994 via protobuf (4.21.9)

protobuf PYPI version 4.21.9 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aviatrix-migration-gcp =0.1.1, =0.0.2, =0.12.0rc6, =0.0.8, =2.0.0, =0.1.4.1, =14.2.0, =14.2.1 Source cves: CVE-2026-0994 Source advisory:...

folio-migration-tools (>=1.0.2, <=1.1.4), json2xml (>=3.10.0rc1, <=3.10.0) potentially affected by CVE-2025-71176 via pytest (7.0.0rc1)

pytest PYPI version 7.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - folio-migration-tools =1.0.2, =3.10.0rc1, =3.10.0 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

SummaryProblem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. DetailsIn the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

PYSEC-2026-1452 Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

Summary Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. Details In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2024-6345 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

accomate (>=1.0.4, <=2.0.0.6), aind-analysis-arch-result-access (>=0.3.0, <=1.2.0) +266 more potentially affected by CVE-2024-5629 via pymongo (>=4.0.0, <=4.6.2)

pymongo PYPI version =4.0.0, =1.0.4, =0.3.0, =0.2.0, =0.1.0, =0.0.27, =0.3.1, =0.1.19, =1.9.0, =0.0.1a0, =0.0.2, =0.4.0, =0.1.0, =0.3.1 and more Source cves: CVE-2024-5629 Source advisory: OSV:PYSEC-2026-1826...

Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

ImpactThe proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to th...

PT-2026-56297

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The legacy oidcProvider and mcp plugins expose an OAuth 2.0 token endpoint that fails to authenticate confidential clients during the refresh token grant. The system authenticates requests based...

PT-2026-67312

Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions prior to 1.7.0-beta.4 Description @better-auth/oauth-provider fails to bind the access-token audience to the authorization grant, which allows clients to request tokens for unrelated resources. This occurs...

PT-2026-67311

Name of the Vulnerable Software and Affected Versions better-auth SCIM versions 1.5.0 through 1.7.0-beta.3 Description By default, the @better-auth/scim plugin fails to bind non-organization personal SCIM providers to their creator. This occurs because the providerOwnership option and the...

PT-2026-67316

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The oidcProvider and mcp plugins contain insecure cryptographic defaults. The discovery document advertises the none algorithm in id token signing alg values supported and resource signing alg...

CVE-2026-46590

The Apache Camel PQC component is vulnerable to CWE-502 Deserialization of Untrusted Data (CVE-2026-46590). The HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and FileBasedKeyLifecycleManager components use a raw java.io.ObjectInputStream.readObject() to deserialize Base...