32567 matches found
PYSEC-2026-2022 phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
Summary A critical performance vulnerability has been identified in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens e.g., , with repeated tokens based on precomputed lengths. Due to inefficient list concatenation operations, the...
CVE-2026-24260
A flaw was found in NVIDIA Container Toolkit. An attacker could exploit a time-of-check time-of-use TOCTOU race condition. This vulnerability might allow an attacker to achieve code execution, escalate privileges, and tamper with data. Mitigation Mitigation for this issue is either not available ...
GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor
Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...
GO-2026-5859 Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration in github.com/fission/fission
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration in github.com/fission/fission...
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...
PYSEC-2026-1923 sigstore has insufficient validation of integration timestamp during verification
Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...
sigstore has insufficient validation of integration timestamp during verification
SummaryVersions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, bu...
Exploit for CVE-2026-39492
CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Ti...
Potential DoS via the Tudoor mechanism in eventlet and dnspython
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in whic...
PYSEC-2026-1602 OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the certmanager.py. component...
OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the certmanager.py. component...
vantage6 vulnerable to a username timing attack on recover password/MFA token
ImpactMuch like https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost, which send emails to users if they have lost their password or MFA token. Usernames can be...
PYSEC-2026-2005 vantage6 vulnerable to a username timing attack on recover password/MFA token
Impact Much like https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost, which send emails to users if they have lost their password or MFA token. Usernames can be...
vantage6 vulnerable to username timing attack
ImpactIt is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks WorkaroundsNo...
Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification
ImpactThe Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application.Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request...
PYSEC-2026-1336 Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification
Impact The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent reque...
Graphite Web Cross-site Scripting vulnerability
A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the publi...
PYSEC-2026-819 Graphite Web Cross-site Scripting vulnerability
A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the publi...