EUVD-2026-110526

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens,...

CVE-2026-116819 OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens,...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2024-6345 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-19...

PT-2026-61760

Name of the Vulnerable Software and Affected Versions praisonai versions 3.11.0 through 4.6.58 Description The Slack bot in PraisonAI fails to apply configured user and channel authorization policies when processing app mention events. While the standard message event handler correctly enforces...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

EUVD-2026-19062

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

The CVE-2026-5557 entry concerns badlogic pi-mono up to version 0.58.4, affecting the pi-mom Slack Bot component’s file packages/mom/src/slack.ts. The documented issue results in an authentication bypass via an alternate channel, with remote execution possible. Public exploitation is noted. No ve...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557: Authentication Bypass Using an Alternate Path or Channel

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

backlogprocessing (>=0.0.0, <=0.0.2), commit-helper (>=3.4.15, <=3.4.16) +9 more potentially affected by CVE-2026-1703 via pip (19.0.3)

pip PYPI version 19.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - backlogprocessing =0.0.0, =3.4.15, =0.0.37, =2.3.7.19022609, =1.4.0, =2019.3.2, =0.0.1, =0.0.14, =0.9.1, =0.9.2 Source cves: CVE-2026-1703 Source advisor...

EUVD-2024-30656

Malicious code in bioql PyPI...

EUVD-2025-6919

Malicious code in bioql PyPI...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory:...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-4...

CVE-2024-8065

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

PT-2025-12218

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version v1.4.1 Description A Cross-Site Request Forgery CSRF issue allows attackers to perform unauthorized actions in the context of the victim's browser, including connecting the victim's application with a malicious Slack...