413 matches found
CVE-2026-58108 Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
CVE-2026-58108
Ericsson CodeChecker 's personal access token deletion query selects from PersonalAccessTokenDB but filters on Session columns without a join. SQLAlchemy resolves this as an implicit cross join, meaning the filter fails to constrain the delete to the calling user's own token. As a result, a suffi...
CVE-2026-58108
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
CVE-2026-58108 Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
EUVD-2026-66297
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
CVE-2026-58108 Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
PT-2026-81974
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
[SECURITY] Fedora 44 Update: python-sqlalchemy-2.0.52-1.fc44
SQLAlchemy is an Object Relational Mapper ORM that provides a flexible, high-level interface to SQL databases. Database and domain concepts are decoupled, allowing both sides maximum flexibility and power. SQLAlchemy provides a powerful mapping layer that can work as automatically or as manual ly...
[SECURITY] Fedora 44 Update: python-alembic-1.19.1-1.fc44
Alembic is a database migration tool written by the author of SQLAlchemy. A migrations tool offers the following functionality: =E2=80=A2 Can emit ALTER statements to a database in order to change the stru cture of tables and other constructs =E2=80=A2 Provides a system whereby "migration scripts...
[SECURITY] Fedora 43 Update: python-sqlalchemy-2.0.52-1.fc43
SQLAlchemy is an Object Relational Mapper ORM that provides a flexible, high-level interface to SQL databases. Database and domain concepts are decoupled, allowing both sides maximum flexibility and power. SQLAlchemy provides a powerful mapping layer that can work as automatically or as manual ly...
[SECURITY] Fedora 43 Update: python-alembic-1.19.1-1.fc43
Alembic is a database migration tool written by the author of SQLAlchemy. A migrations tool offers the following functionality: =E2=80=A2 Can emit ALTER statements to a database in order to change the stru cture of tables and other constructs =E2=80=A2 Provides a system whereby "migration scripts...
Fedora 44 : python-alembic / python-asyncmy / python-sqlalchemy (2026-6f7b906353)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-6f7b906353 advisory. This update contains new upstream releases for python-sqlalchemy bugfixes, python-alembic bugfixes and python-asyncmy bugfixes, security fixes and...
Fedora 43 : python-alembic / python-asyncmy / python-sqlalchemy (2026-7d816931eb)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-7d816931eb advisory. This update contains new upstream releases for python-sqlalchemy bugfixes, python-alembic bugfixes and python-asyncmy bugfixes, security fixes and...
PT-2026-80648
Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...
PT-2026-80268
Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...
EulerOS 2.0 SP11 : python-sqlalchemy (EulerOS-SA-2026-3151)
According to the versions of the python-sqlalchemy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a...
gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-69248 via cryptography (3.4.3)
cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...
gcloud-connectors (>=0.1.58b10, <=0.1.62), spsdk (>=1.3.0, <=1.5.0) +1 more potentially affected by CVE-2026-69249 via cryptography (3.4.3)
cryptography PYPI version 3.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - gcloud-connectors =0.1.58b10, =1.3.0, =0.1.29, =0.1.32 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...
Sqlalchemy Mako Path Traversal
The vulnerability of the Sqlalchemy mako Python template library relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Sqlalchemy Mako Path Traversal
The vulnerability of the Sqlalchemy mako Python template library relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...