graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-2635 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-2635 Source advisory: OSV:PYSEC-2026-421...

PYSEC-2026-414 misp-modules website - Missing CSRF protection in the website home blueprint

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of sessi...

PYSEC-2026-452 pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-0545 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-0545 Source advisory: OSV:PYSEC-2026-419...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2025-15379 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2025-15379 Source advisory: OSV:PYSEC-2026-423...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-0596 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-0596 Source advisory: OSV:PYSEC-2026-424...

graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2025-15036 via mlflow (2.1.1)

mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2025-15036 Source advisory: OSV:PYSEC-2026-425...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules (CVE-2026-45736, CVE-2026-45149, CVE-2026-3449 & CVE-2026-8723)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules. Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws ...

PT-2026-53496

A Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of sessi...

WEB-EXPLOITATION-ARSENAL-v1.0

Web Exploitation Arsenal v1.0 A comprehensive, modular web ap...

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

Summary pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a...

External Control of File Name or Path

Overview @pnpm/installing.deps-resolver is a Resolves dependency graph of a package Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules...

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

pnpm: Hoisted install imports lockfile alias outside node_modules

Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases suc...

PT-2026-55948

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.4 pnpm versions prior to 11.7.0 Description A crafted lockfile alias can be joined directly under a hoisted node modules directory. Traversal aliases may allow escaping that directory, while reserved aliases such a...

EulerOS 2.0 SP15 : openssl (EulerOS-SA-2026-2497)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Applications using RSASVE key encapsulation to establishx000D a secret encryption key can send contents of an uninitialized memory...

Relative Path Traversal

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Relative Path Traversal in dependency alias handling, which passes alias names from package metadata into dependency linking as path components and normalizes them with path.join...

EUVD-2026-39652

Dell Dell Container Storage Modules, versions csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access...

CVE-2026-40711

Dell Dell Container Storage Modules, versions csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access...