io.spinnaker.orca:orca-api-tck (8.39.0), io.spinnaker.orca:orca-applications (8.39.0) +38 more potentially affected by CVE-2026-44795 via io.spinnaker.orca:orca-core (8.39.0)

io.spinnaker.orca:orca-core MAVEN version 8.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.orca:orca-core and may be impacted: - io.spinnaker.orca:orca-api-tck 8.39.0 - io.spinnaker.orca:orca-applications 8.39.0 -...

io.spinnaker.kayenta:kayenta-atlas (2.36.1), io.spinnaker.kayenta:kayenta-aws (2.36.1) +63 more potentially affected by CVE-2026-44795 via io.spinnaker.orca:orca-core (8.31.1)

io.spinnaker.orca:orca-core MAVEN version 8.31.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.orca:orca-core and may be impacted: - io.spinnaker.kayenta:kayenta-atlas 2.36.1 - io.spinnaker.kayenta:kayenta-aws 2.36.1 -...

io.spinnaker.orca:orca-applications (8.17.1), io.spinnaker.orca:orca-bakery (8.17.1) +25 more potentially affected by CVE-2026-44795 via io.spinnaker.orca:orca-core (8.17.1)

io.spinnaker.orca:orca-core MAVEN version 8.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.orca:orca-core and may be impacted: - io.spinnaker.orca:orca-applications 8.17.1 - io.spinnaker.orca:orca-bakery 8.17.1 -...

io.spinnaker.kayenta:kayenta-atlas (2.40.4), io.spinnaker.kayenta:kayenta-aws (2.40.4) +63 more potentially affected by CVE-2026-44795 via io.spinnaker.orca:orca-core (8.51.3)

io.spinnaker.orca:orca-core MAVEN version 8.51.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.orca:orca-core and may be impacted: - io.spinnaker.kayenta:kayenta-atlas 2.40.4 - io.spinnaker.kayenta:kayenta-aws 2.40.4 -...

CVE-2026-25599

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-10783 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-10783 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

CVE-2026-25599

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-48726 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-48726 Source advisory: OSV:GHSA-VR7M-C6V4-8CX8...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-46764 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-46764 Source advisory: OSV:GHSA-QPHR-3MVQ-V466...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-42360 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-42360 Source advisory: OSV:GHSA-CG3X-89RC-X9MW...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-45192 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-45192 Source advisory: OSV:GHSA-2883-WWH7-X57V...

CVE-2026-25599 Missing authentication and clear‑text data transmission affecting Orca heat pumps

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

CVE-2026-25599

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

EUVD-2026-33617

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

CVE-2026-25599 Missing authentication and clear‑text data transmission affecting Orca heat pumps

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...

CVE-2026-25599

CVE-2026-25599 involves Orca heat pump devices communicating with the Orca server over unencrypted HTTP, with missing authentication and input validation on aggregated data. This combination enables stored XSS in the heat pump web control interface and potential cookie theft, as well as attacker ...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-48726 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-48726 Source advisory: OSV:PYSEC-2026-187...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-42360 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-42360 Source advisory: OSV:PYSEC-2026-172...

airgoodies (>=0.0.1a0, <=0.0.4), py-orca (>=1.3.4, <=1.3.5) potentially affected by CVE-2026-40861 via apache-airflow (2.7.2)

apache-airflow PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airgoodies =0.0.1a0, =1.3.4, =1.3.5 Source cves: CVE-2026-40861 Source advisory: OSV:PYSEC-2026-181...