111127 matches found
PYSEC-2026-2448 Django vulnerable to Uncontrolled Resource Consumption
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...
PYSEC-2026-2584 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Summary The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. ---...
PYSEC-2026-2562 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
Server-Side Request Forgery SSRF in ChatOpenAI Image Token Counting Summary The ChatOpenAI.getnumtokensfrommessages method fetches arbitrary imageurl values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery SSRF...
PYSEC-2026-3413 web2py has an Open Redirect Vulnerability
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing atta...
PYSEC-2026-2976 Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...
PYSEC-2026-2980 Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...
SUSE-SU-2026:22643-1 Security update for go1.25
This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. - CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. - CVE-2026-27142: html/template: URLs in meta content...
PYSEC-2026-2453 Docassemble unauthorized access through URL manipulation
Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...
MAL-2026-10444 Malicious code in markable-table (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...
OPENSUSE-SU-2026:21319-1 Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session...
CVE-2026-57805
creationtimestamp| type| source ---|---|--- 2026-07-13 12:34:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjpbecik52e...
CVE-2026-61955
creationtimestamp| type| source ---|---|--- 2026-07-13 11:59:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjndygvcm2y 2026-07-13 18:04:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbqk2co427 2026-07-14 02:02:07+00:00| seen|...
CVE-2026-61956
creationtimestamp| type| source ---|---|--- 2026-07-13 11:56:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn5hwcrf2f 2026-07-13 19:45:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhf5qieu2c 2026-07-14 02:20:58+00:00| seen|...
CVE-2026-59521
creationtimestamp| type| source ---|---|--- 2026-07-13 11:55:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn4eonhm2z 2026-07-13 19:45:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhecakde22 2026-07-14 02:20:17+00:00| seen|...
CVE-2026-59516
creationtimestamp| type| source ---|---|--- 2026-07-13 11:54:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjn2rtdon22 2026-07-13 19:04:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkf3xenwt2z 2026-07-14 02:05:01+00:00| seen|...
CVE-2026-57734
creationtimestamp| type| source ---|---|--- 2026-07-13 11:21:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjla432an2y...
CVE-2026-57733
creationtimestamp| type| source ---|---|--- 2026-07-13 11:21:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl6z33xh27 2026-07-13 21:33:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqknexzdpt27 2026-07-16 07:57:09+00:00| seen|...
CVE-2026-57728
creationtimestamp| type| source ---|---|--- 2026-07-13 11:19:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl3decem2e 2026-07-16 07:56:52+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr6ay6ty2b...