tfhub-styletransfer-wrapper (>=1.0.5, <=1.1.1), tpu-tf2 (1.0.0) potentially affected by CVE-2022-29192 via tensorflow-gpu (2.7.0)

tensorflow-gpu PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - tfhub-styletransfer-wrapper =1.0.5, =1.1.1 - tpu-tf2 1.0.0 Source cves: CVE-2022-29192 Source advisory: OSV:PYSEC-2026-1002...

tfhub-styletransfer-wrapper (>=1.0.5, <=1.1.1), tpu-tf2 (1.0.0) potentially affected by CVE-2022-29193 via tensorflow-gpu (2.7.0)

tensorflow-gpu PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - tfhub-styletransfer-wrapper =1.0.5, =1.1.1 - tpu-tf2 1.0.0 Source cves: CVE-2022-29193 Source advisory: OSV:PYSEC-2026-942...

NLTK Stanford wrapper classes execute untrusted JAR files without verification

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute...

Oracle Linux 9 : mariadb:10.11 (ELSA-2026-33482)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-33482 advisory. galera 26.4.20-1.0.1 - Drop nmap-ncat requirement. Orabug: 34116228 - Requirement to delete garbd-wrapper script and lp1184034 test case without using patches...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-49852 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-49852 Source advisory: OSV:GHSA-GG9X-QCX2-XMRH...

NPM: OpenClaw: Shell wrapper argv could change between approval and execution

NPM: OpenClaw: Shell wrapper argv could change between approval and execution vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.16...

OpenClaw: Shell wrapper argv could change between approval and execution

Summary Shell wrapper argv could change between approval and execution. In affected versions, a command request using a shell wrapper form could approve one resolved argv shape and rebuild another for execution. This advisory is scoped to the named feature and configuration. It does not change...

GHSA-2J8V-HWGC-X698 OpenClaw: Shell wrapper argv could change between approval and execution

Summary Shell wrapper argv could change between approval and execution. In affected versions, a command request using a shell wrapper form could approve one resolved argv shape and rebuild another for execution. This advisory is scoped to the named feature and configuration. It does not change...

tfhub-styletransfer-wrapper (>=1.0.5, <=1.1.1), tpu-tf2 (1.0.0) potentially affected by CVE-2022-23594 via tensorflow-gpu (2.7.0)

tensorflow-gpu PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - tfhub-styletransfer-wrapper =1.0.5, =1.1.1 - tpu-tf2 1.0.0 Source cves: CVE-2022-23594 Source advisory: OSV:PYSEC-2026-752...

PT-2026-55296

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.18 Description Authenticated attackers can perform server-side request forgery SSRF, a flaw where the server is tricked into making requests to an unintended location. By providing malicious input to th...

mariadb:10.11 security, bug fix, and enhancement update

galera 26.4.20-1.0.1 - Drop nmap-ncat requirement. Orabug: 34116228 - Requirement to delete garbd-wrapper script and lp1184034 test case without using patches. Orabug: 34116228 26.4.20-1 - Rebase to 26.4.20 26.4.19-1 - Rebase to 26.4.19 26.4.18-1 - Rebase to 26.4.18 26.4.16-1 - Rebase to 26.4.16...

autotrain-advanced (>=0.6.14, <=0.6.15.dev0), llama2-wrapper (>=0.1.0, <=0.1.14) potentially affected by CVE-2026-49119 via gradio (3.37.0)

gradio PYPI version 3.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.14, =0.1.0, =0.1.14 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

io.camunda:camunda-zeebe (>=8.10.0-alpha1-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=4.151.3) +3 more potentially affected by CVE-2026-14265 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =8.10.0-alpha1-rc1, =4.128.0, =4.151.3 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack...

CVE-2026-14265

The CVE affects AWS Advanced JDBC Wrapper (AWR) RemoteQueryCachePlugin versions 3.3.0–4.0.0. Deserialization of untrusted data via ObjectInputStream without class filtering when reading cached query results from Redis or Valkey enables gadget-chain execution, allowing arbitrary code execution on ...

io.camunda:camunda-zeebe (>=8.10.0-alpha1-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=4.151.3) +3 more potentially affected by CVE-2026-14265 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =8.10.0-alpha1-rc1, =4.128.0, =4.151.3 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack...

CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a...

External Control of File Name or Path

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

autotrain-advanced (>=0.6.14, <=0.6.15.dev0), llama2-wrapper (>=0.1.0, <=0.1.14) potentially affected by CVE-2026-49119 via gradio (3.37.0)

gradio PYPI version 3.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.14, =0.1.0, =0.1.14 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

EUVD-2026-40934

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classwrapperform' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections method at line 98, wher...

CVE-2026-12732 LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classwrapperform' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections method at line 98, wher...