2323 matches found
CVE-2026-114040
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.getmodelmeta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack...
CVE-2026-114040 DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.getmodelmeta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack...
EUVD-2026-107040
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.getmodelmeta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack...
CVE-2026-114040
A path traversal vulnerability exists in DT42 BerryNet up to version 3.10.2 . The flaw is located in the Model Package Metadata Handler component, specifically within the DLModelManager.get_model_meta function of the berrynet/dlmodelmgr.py file. An attacker can exploit this by manipulating the la...
CVE-2026-114040 DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.getmodelmeta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack...
PT-2026-120438
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get model meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The atta...
BIT-JUPYTERLAB-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
OESA-2026-4168 python-jupyterlab security update
JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab before 4.5.9...
Astra Linux – Vulnerability in Composer
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method. This vulnerability occurs when the $sourceReference parameter is appended to a shell command without proper escaping...
GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
CVE-2026-82710
usage_rules (ash-project, Elixir Mix task) is vulnerable to terminal escape sequence injection via the Mix.Tasks.UsageRules.SearchDocs formatter. Publisher-controlled fields from Hex documentation are interpolated verbatim without neutralizing terminal control characters, allowing a malicious pac...
CVE-2026-82584
ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...
CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
EUVD-2026-72554
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
EEF-CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's...
CVE-2026-70550
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...
EUVD-2026-65546
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...
CVE-2026-70547
An authenticated user without repository read permission may access package metadata under specific conditions...
