CVE-2026-55772

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

EUVD-2026-43522

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55772

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-49970 Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination. Attackers can exploit the permissive...

CVE-2026-49970

Vulnerability summary: Laravel-Mediable before 7.0.0 contains a path traversal flaw in File::sanitizePath() that lets attackers write uploaded files to arbitrary locations via MediaUploader::toDestination(), due to a permissive regex allowing dot/slash and a weak trailing trim. This can enable re...

MAL-2026-10462 Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

CVE-2026-61504 Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name...

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Summaryisglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny":pythondef...

PYSEC-2026-2519 OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

SummaryThe ydoc:document:join Socket.IO handler checks note ownership only when the documentid starts with note: colon. However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores documentid.replace":", "". An attacker can join a document room using not...

diagram-to-iac (>=1.0.10, <=1.18.0), portia-sdk-python-rfares (0.4.10) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.16)

langchain-anthropic PYPI version 0.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - diagram-to-iac =1.0.10, =1.18.0 - portia-sdk-python-rfares 0.4.10 Source cves: CVE-2026-55443 Source advisory:...

ai-security-analyzer (>=0.0.45, <=0.0.55), browser-use (>=0.2.6, <=0.3.2) +3 more potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.15)

langchain-anthropic PYPI version 0.3.15 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - ai-security-analyzer =0.0.45, =0.2.6, =0.8.0, =0.4.1, =0.5.4 - re-browser-use 0.3.2 Source cves: CVE-2026-55443 Source...

PYSEC-2026-2861 PDM wheel installation leads to Path Traversal via overridden write_to_fs

InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir which validates via Path.resolve + isrelativeto with a bare os.path.join that performs no path validation. A malicious wheel with travers...

Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the getospath function within jupyterserver/services/contents/fileio.py. The check uses startswithroot without appending a trailing path separator, allowing sibling...

mahoraga (>=0.5.1, <=0.6.0), pixi-browse (>=0.0.1, <=0.0.13) +5 more potentially affected by CVE-2026-47425 via py-rattler (>=0.5.0, <=0.23.2)

py-rattler PYPI version =0.5.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.3 Source cves: CVE-2026-47425 Source advisory: OSV:PYSEC-2026-2971...

aiq-platform-api (>=1.0.17, <=1.0.57), archive-to-images (1.0.0) +24 more potentially affected by CVE-2026-44722 via pyzipper (>=0.3.5, <=0.3.6)

pyzipper PYPI version =0.3.5, =1.0.17, =0.1.5, =1.0.0, =0.0.1, =0.1.2, =1.3.5.5, =1.2.1, =0.0.1, =1.0.1, =0.0.11, =1.0.17 - jsw-jzyunqi 1.0.5 and more Source cves: CVE-2026-44722 Source advisory: OSV:PYSEC-2026-3044...

Open WebUI has stored XSS in Excel file preview

SummaryExcel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. DetailsThe...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-42557 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...