Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 79 available sources using the dropdown above.
| ID | Severity | Description | Package | Published | Updated |
|---|---|---|---|---|---|
| pysec-2026-3682 |
5.5 (3.1)
|
## Summary Every Linuxfabrik check plugin that supports the shared `--test` argument (rou… | linuxfabrik-lib | 2026-08-19T11:56:28.745844Z | 2026-08-19T12:16:28.037522Z |
| pysec-2026-3678 |
7.3 (3.1)
|
## Summary Repo under test: https://github.com/Netflix/lemur `PUT /api/1/certificates/<… | lemur | 2026-08-19T11:56:28.618014Z | 2026-08-19T12:16:27.578924Z |
| pysec-2026-3673 |
4.3 (3.1)
|
## Summary The `CertificateExport` handler in `lemur/certificates/views.py` nests its e… | lemur | 2026-08-19T11:56:28.566866Z | 2026-08-19T12:16:27.253040Z |
| pysec-2026-3677 |
6.5 (3.1)
|
## Summary Repo under test: https://github.com/Netflix/lemur When `ADMIN_ONLY_AUTHORITY… | lemur | 2026-08-19T11:56:28.516318Z | 2026-08-19T12:16:27.512565Z |
| pysec-2026-3675 |
8.1 (3.1)
|
## Summary Repo under test: https://github.com/Netflix/lemur The certificate create and… | lemur | 2026-08-19T11:56:28.471176Z | 2026-08-19T12:16:27.385205Z |
| pysec-2026-3674 |
7.7 (3.1)
|
### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api… | lemur | 2026-08-19T11:56:28.427292Z | 2026-08-19T12:16:27.319532Z |
| pysec-2026-3679 |
7.7 (3.1)
|
### Summary The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme… | lemur | 2026-08-19T11:56:28.379754Z | 2026-08-19T12:16:27.646236Z |
| pysec-2026-3676 |
6.3 (3.1)
|
## Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()… | lemur | 2026-08-19T11:56:28.331384Z | 2026-08-19T12:16:27.451309Z |
| pysec-2026-3680 |
7.4 (3.1)
|
### Summary The ACME client (used to issue certificates from Let's Encrypt / Google Publi… | lemur | 2026-08-19T11:56:28.286395Z | 2026-08-19T12:16:27.713871Z |
| pysec-2026-3661 |
6.5 (3.1)
|
### Impact If the replication protocol is enabled by using the ``primary`` (or deprecate… | devpi-server | 2026-08-19T11:56:28.164114Z | 2026-08-19T12:16:22.806367Z |
| pysec-2026-3701 |
9.8 (3.1)
|
### Impact Prior to version 0.0.19, surfio would not correctly validate size fields in ir… | surfio | 2026-08-19T11:56:28.037745Z | 2026-08-19T12:16:39.528927Z |
| pysec-2026-3694 |
9.8 (3.1)
|
### Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL fi… | resdata | 2026-08-19T11:56:27.903833Z | 2026-08-19T12:16:38.889157Z |
| pysec-2026-3689 |
5.5 (3.1)
|
### Summary The `find_icon_path_zip()` function in MobSF does not properly sanitize the `… | mobsf | 2026-08-19T11:56:27.765901Z | 2026-08-19T12:16:29.724461Z |
| pysec-2026-3688 |
6.5 (3.1)
|
### Summary Django's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLAS… | mobsf | 2026-08-19T11:56:27.721821Z | 2026-08-19T12:16:29.664347Z |
| pysec-2026-3690 |
3.0 (3.1)
|
## Summary MobSF's Android App Link assetlinks checker validates only the manifest `andr… | mobsf | 2026-08-19T11:56:27.673423Z | 2026-08-19T12:16:29.784292Z |
| pysec-2026-3691 |
4.9 (3.1)
|
### Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exc… | mobsf | 2026-08-19T11:56:27.628217Z | 2026-08-19T12:16:29.842803Z |
| pysec-2026-3662 |
7.5 (3.1)
|
### Summary Multiple GeoLens read/link endpoints authorized only the resource named in t… | geolens | 2026-08-19T11:56:27.504188Z | 2026-08-19T12:16:24.722815Z |
| pysec-2026-3663 |
7.5 (3.1)
|
### Summary Multiple GeoLens read/link endpoints authorized only the resource named in t… | geolens-cli | 2026-08-19T11:56:27.453934Z | 2026-08-19T12:16:24.659936Z |
| pysec-2026-3660 |
4.3 (3.1)
|
A valid filekey could potentially be converted into a dirkey, granting read-access to the… | copyparty | 2026-08-19T11:56:27.329507Z | 2026-08-19T12:16:20.894958Z |
| pysec-2026-3687 |
9.3 (3.1)
|
### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, defau… | mlflow | 2026-08-19T11:56:27.173497Z | 2026-08-19T12:16:29.428379Z |
| pysec-2026-3698 |
7.5 (3.1)
|
### Summary sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerabili… | sqlparse | 2026-08-19T11:56:27.110256Z | 2026-08-19T12:16:39.242165Z |
| pysec-2026-3699 |
8.7 (4.0)
|
### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS… | sqlparse | 2026-08-19T11:56:27.060920Z | 2026-08-19T12:16:39.313909Z |
| pysec-2026-3697 |
8.7 (4.0)
|
### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). #… | sqlparse | 2026-08-19T11:56:27.016412Z | 2026-08-19T12:16:39.177334Z |
| pysec-2026-3664 |
5.3 (3.1)
|
## Summary Glances provides `as_dict_secure()` explicitly designed for unauthenticated A… | glances | 2026-08-19T11:56:26.971395Z | 2026-08-19T12:16:24.791053Z |
| pysec-2026-3665 |
7.1 (4.0)
|
## Summary In Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc… | glances | 2026-08-19T11:56:26.920450Z | 2026-08-19T12:16:24.859967Z |
| pysec-2026-3666 |
8.8 (3.1)
|
## Summary CVE-2026-32608 ("Command Injection via Process Names in Action Command Templat… | glances | 2026-08-19T11:56:26.862162Z | 2026-08-19T12:16:24.926132Z |
| pysec-2026-3696 |
6.2 (4.0)
|
### Summary The documented Python and PHP output modes generate source-code snippets fro… | sqlparse | 2026-08-19T11:56:26.811298Z | 2026-08-19T12:16:39.119951Z |
| pysec-2026-3667 |
6.5 (3.1)
|
### Summary Glances's REST API server includes a documented safety check intended to guar… | glances | 2026-08-19T11:56:26.767601Z | 2026-08-19T12:16:24.992053Z |
| pysec-2026-3668 |
8.8 (4.0)
|
### Summary The Glances action system lets an administrator configure shell commands tha… | glances | 2026-08-19T11:56:26.704895Z | 2026-08-19T12:16:25.062749Z |
| pysec-2026-3684 |
6.6 (3.1)
|
## Summary The `/admin/gateways/test` endpoint validates submitted URLs by resolving the… | mcp-contextforge-gateway | 2026-08-19T11:56:26.562796Z | 2026-08-19T12:16:28.861354Z |