PT-2026-110978

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.70.9 Description On accounts with Role-Based Access Control RBAC enabled via a plan where has rbac is set to true, certain private flow-read routes fail to properly enforce authorization checks. Specifically, the...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-81569 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-81569 Source advisory: MEND:CVE-2026-81569...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview kartykp-prod-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14571 Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14575 Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @hd-team/app-impkg-prod is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @hd-team/app-dnpkg-prod is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

PYSEC-2026-1973 TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2026-47340 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2026-41280 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-32967 Source advisory: MEND:CVE-2026-32967...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-41280 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-41280 Source advisory: MEND:CVE-2026-41280...

EUVD-2026-26033

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /viewprod.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used...