44552 matches found
cloudmesh-client (>=4.5.0, <=4.7.3), django-ca (>=1.5.0, <=1.5.1) +5 more potentially affected by CVE-2026-69249 via cryptography (1.7.2)
cryptography PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - cloudmesh-client =4.5.0, =1.5.0, =0.5.1, =1.0.0, =5.4.0, =2.2.2, =0.7.0, =0.7.3 Source cves: CVE-2026-69249 Source advisory:...
PYSEC-2026-3569 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
Summary The HTTP modules that DO call the SSRF guard http.get, http.request, http.batch validate only the initial URL, then issue the request with aiohttp's default allowredirects=True and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; t...
PYSEC-2026-3565 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
Summary datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
SummaryTwo regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such...
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
SummaryHeap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read i...
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the webfetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the...
MAL-2026-11971 Malicious code in flat-cache (npm)
npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...
WordPress Wholesale for WooCommerce plugin <= 2.0.5 - Authenticated (Author+) Privilege Escalation vulnerability
Authenticated Author+ Privilege Escalation vulnerability discovered by Chloe Chamberland, Wordfence PRISM in WordPress Plugin Wholesale For WooCommerce Lite – B2B & B2C Solution versions = 2.0.5...
Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters
Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...
WordPress Academy LMS plugin <= 3.8.2 - Subscriber+ Sensitive Information Disclosure vulnerability
Subscriber+ Sensitive Information Disclosure vulnerability discovered by Stefan Spasic in WordPress Plugin Academy LMS versions = 3.8.2...
CVE-2026-16035 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...
Rocket.Chat v8.7.0-rc.4
The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...
OSV-2026-1109 UNKNOWN READ in sens_to_cil
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541965633 Crash type: UNKNOWN READ Crash state: senstocil additivescopestocilmap hashtabmap...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the buildchaininner function. An attacker can cause excessive resource consumption by submitting a certificate chain containing duplicate self-signed intermediates, which lead...
PT-2026-71431
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description An issue exists where the software fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint. This allows unauthenticated attackers to abuse private chatflow text-to-speech...
PT-2026-75726
TuxCare rebuilt estree-util-value-to-estree to address 1 CVE. Fixed in 1.3.0-tuxcare.1...
PT-2026-76457
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541965633 Crash type: UNKNOWN READ Crash state: sens to cil additive scopes to cil map hashtab map...
PT-2026-74605
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.3-tuxcare.2...
PT-2026-67886
Name of the Vulnerable Software and Affected Versions Ghost versions 0.10.0 through 6.54.0 Description A path traversal issue in custom themes allows a staff user to write files outside of the uploads directory. This occurs due to improper theme storage name handling in LocalStorageBase, which...