RCE (Remote Code Execution) ws Dependency in Bitbucket Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) in Bitbucket Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS...

PT-2026-60379

Name of the Vulnerable Software and Affected Versions affected versions not specified Description When used with the permessage-deflate extension, a WebSocket server or client may accept messages exceeding the configured maximum size. This occurs because the size limit is validated against the...

PT-2026-58896

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An authenticated user with permissions to view offices can perform a time-based blind SQL injection via the 'Office Search API' endpoint '/api/v1/offices'. The issue occurs because the order...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization via the authorization process. An attacker can bypass security measures and gain unauthorized read access by leveraging high privileges without...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to the POST /ui/hosts process not honoring configured enrollment token TTL settings and instead issuing tokens with a fixed 24-hour validity. An attacker can obtain enrollment tokens with a...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the caption-download process. An attacker can overwrite or create arbitrary files on the system by supplying a crafted file parameter to the MCP server, allowing modification of files outsid...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the TGA RLE encoder process. An attacker can access sensitive heap data and potentially cause limited denial of service by crafting a specially designed image file. Remediation Upgrade pillow to version 12.3.0 or...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object...

CVE-2026-15736

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

CVE-2026-15736 Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

Information Exposure

Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Information Exposure via the crawler that tries to prevent confidential HTTP client options from bei...

PT-2026-58856

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 22.1.1 through 22.1.7 Description An authentication bypass exists in the Avi Controller control...

PYSEC-2026-2345 Apache Airflow: Authenticated users can bypass the `is_safe_url` check

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

PYSEC-2026-3437 zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion

Impact DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dict keyed by strsys.excinfo1. The seven IncomingDecodeError messages raised from readname / decodelabelsatoffset RFC 6762 §18 name-decoding error paths all embed self.source — the...

PYSEC-2026-3436 zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service

Impact DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer RFC 1035 §4.1.4. Pointer cycles and label counts were capped, but the chain length of unique forward pointers was not. A single 3 kB mDNS packet carrying 1500 chained pointers drives the recursion past CPython'...

PYSEC-2026-2366 Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability CWE-90 that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP...

CVE-2026-58065 Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification

The Apache Airflow Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server man-in-the-middle, capturing the S...

PYSEC-2026-2545 kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write

Impact PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured...

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. Mitigation There is no mitigation or workarou...