delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-41909 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-41909 Source...

PYSEC-2026-837 Cross-site Scripting in kiwitcms

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack clickjacking and an HTML injection which disables the use of the history page...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-35972 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-35972 Source...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-35968 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-35968 Source...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2026-48892 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2026-48892 Source advisory:...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

python3.14-pip security update

25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...

GHSA-473P-56XX-VG67 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

Cross-site Scripting (XSS)

Overview kiwitcms is a Test Case Management System Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extralink field in TestPlan and TestCase components. An attacker can inject and execute arbitrary JavaScript code by submitting specially crafted input to these...

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...

Malicious Package

Overview test-prettier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-6893 Malicious code in test-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e81aaf3ca98b6be66b1dd1e6c1c2de4d9487b31d82e74d6c8283b9d9d5a8ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e81aaf3ca98b6be66b1dd1e6c1c2de4d9487b31d82e74d6c8283b9d9d5a8ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6808 Malicious code in chain-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77e7f01c553ac23e33093f616c3643869064c384e748db9a383cdcf854a07976 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chain-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77e7f01c553ac23e33093f616c3643869064c384e748db9a383cdcf854a07976 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview chain-await-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-integration-test-sap-netweaver (>=3.35.0, <=3.36.0) +3 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty-http (>=4.19.0, <=4.20.0)

org.apache.camel:camel-netty-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-42527 Source advisory: OSV:GHSA-8H6P-JVHF-9HCR...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-29205 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-29205 Source...