25 matches found
PT-2026-98991
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the is install allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The...
NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API
NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...
EUVD-2026-84867
Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...
Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab contains a...
Linux Distros Unpatched Vulnerability : CVE-2026-73626
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the...
SUSE CVE-2026-73626
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
DEBIAN-CVE-2026-73626
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-73626
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-73626
CVE-2026-73626 is a HIGH severity (CVSS 3.1: 7.5) vulnerability in JupyterLab versions >=4.6.0, <=4.6.1 and
CVE-2026-73626
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-73626: Improper Access Control
JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...
CVE-2026-49467
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...
EUVD-2026-57356
Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...
GHSA-WHVH-WF3X-G77J JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
The extension allowlist/blocklist check inside PyPIExtensionManager.install was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install was intended to enforce the allowlist/blocklist itself for any future uses and users calling this...
PT-2026-71454
Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.6.0 through 4.6.1 JupyterLab versions 4.5.0 through 4.5.9 Description An enforcement gap exists in the PyPIExtensionManager.install function due to a missing await keyword, which prevents the is install allowed coroutine...
Authorization Bypass
StudioCMS is vulnerable to Improper Access Control. The vulnerability is due to missing await handling for the asynchronous isAuthorized function in the S3 storage manager, where authorization checks in the POST and PUT handlers always evaluate as successful because unresolved Promise objects are...
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...
GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...