Unspecified security issues.

CPANSA-MySQL-Admin-1-1

Unspecified security issues.

cpan

No PRs yet

Unbounded response body buffering and decompression in hackney

EEF-CVE-2026-97200 CVE-2026-97200 HIGH about 8 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in `hackney_conn` in benoitc hackney allows a malicious HTTP server ...

hex

No PRs yet

Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

EEF-CVE-2026-115693 CVE-2026-115693 CRITICAL about 8 hours ago

## Summary Improper Certificate Validation vulnerability in `hackney_ssl` in benoitc hackney allows an on-path attacker to impersonate a server pi...

hex

No PRs yet

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

EEF-CVE-2026-113440 CVE-2026-113440 MEDIUM about 8 hours ago

## Summary Insufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_aut...

hex

No PRs yet

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

EEF-CVE-2026-115700 CVE-2026-115700 MEDIUM about 8 hours ago

## Summary Interpretation Conflict vulnerability in `hackney_url` in benoitc hackney allows Server Side Request Forgery via a percent-encoded brac...

hex

No PRs yet

CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

EEF-CVE-2026-112880 CVE-2026-112880 LOW about 8 hours ago

## Summary Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in `hackney_http_connect` i...

hex

No PRs yet

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

EEF-CVE-2026-108529 GHSA-j363-h72p-296m CVE-2026-108529 HIGH about 9 hours ago

## Summary Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attack...

hex

No PRs yet

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

EEF-CVE-2026-110499 GHSA-47x4-3fxf-82fr CVE-2026-110499 HIGH about 9 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthentic...

hex

No PRs yet

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

EEF-CVE-2026-109584 GHSA-7gfj-7gvq-3xqj CVE-2026-109584 HIGH about 9 hours ago

## Summary Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an...

hex

No PRs yet

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

EEF-CVE-2026-111103 GHSA-2238-pgfc-w82m CVE-2026-111103 HIGH about 9 hours ago

## Summary Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to...

hex

No PRs yet

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

EEF-CVE-2026-111101 GHSA-jwh3-j29h-qfmw CVE-2026-111101 HIGH about 9 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unau...

hex

No PRs yet

Quadratic bignum parsing of Content-Length and Host port values in Bandit

EEF-CVE-2026-113436 GHSA-29cr-8477-rg6r CVE-2026-113436 HIGH about 9 hours ago

## Summary Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attack...

hex

No PRs yet

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

EEF-CVE-2026-110314 GHSA-2v5v-8f9v-xh85 CVE-2026-110314 MEDIUM about 9 hours ago

## Summary Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote cl...

hex

No PRs yet

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

EEF-CVE-2026-114213 GHSA-cpx7-qf6w-jc63 CVE-2026-114213 HIGH about 9 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an una...

hex

No PRs yet

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

EEF-CVE-2026-114216 GHSA-w5wc-g2hc-g7m2 CVE-2026-114216 MEDIUM about 9 hours ago

## Summary Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of m...

hex

No PRs yet

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

EEF-CVE-2026-115269 GHSA-p2qv-vx88-385x CVE-2026-115269 HIGH about 9 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauth...

hex

No PRs yet

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

EEF-CVE-2026-108525 GHSA-c3g7-2pg5-qvwh CVE-2026-108525 HIGH about 9 hours ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthentic...

hex

No PRs yet

An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

EEF-CVE-2026-96581 GHSA-vw7c-67pf-gh96 CVE-2026-96581 HIGH about 15 hours ago

## Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and ta...

hex

No PRs yet

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

EEF-CVE-2026-115627 GHSA-gr2r-f49c-9gm2 CVE-2026-115627 MEDIUM 1 day ago

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record o...

hex

No PRs yet

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

EEF-CVE-2026-115635 GHSA-36hg-wwp2-fg8w CVE-2026-115635 MEDIUM 1 day ago

## Summary Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upser...

hex

No PRs yet

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

EEF-CVE-2026-114214 GHSA-g2h4-xp57-q863 CVE-2026-114214 MEDIUM 1 day ago

## Summary Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record thr...

hex

No PRs yet

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.

CPANSA-Web-Simple-2026-114629 CVE-2026-114629 3 days ago

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::Par...

cpan

No PRs yet

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

GHSA-jqc4-5cvw-7w85 CVE-2026-112937 MODERATE 3 days ago

`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) remove their private `.filelock-*` link directories with `shutil.rm...

pypi

No PRs yet

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

GHSA-9vhv-jxww-xfm5 CVE-2026-112913 LOW 3 days ago

On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in eve...

pypi

No PRs yet

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

GHSA-567q-5qvw-pf92 CVE-2026-112907 LOW 3 days ago

On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock...

pypi

No PRs yet

virtualenv: Temporary app-data can leave dangling seed package links

GHSA-4f8h-vr72-p32c CVE-2026-113713 MODERATE 3 days ago

## Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The envi...

pypi

No PRs yet

virtualenv: Pip seeding with download omits wheel digest verification

GHSA-cx28-75q4-x26q CVE-2026-113717 LOW 3 days ago

## Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates ...

pypi

No PRs yet

virtualenv: Downloaded wheel selection and caching precede verification

GHSA-494p-63j8-28p3 CVE-2026-113714 LOW 3 days ago

## Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verifi...

pypi

No PRs yet

virtualenv: Xonsh activation literals depend on the script decoding codec

GHSA-394h-qwmc-48pf CVE-2026-113718 HIGH 3 days ago

## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to...

pypi

No PRs yet

virtualenv: Seeded files retain permissions from an older cache

GHSA-fc2g-4w5p-6whm CVE-2026-113720 MODERATE 3 days ago

## Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated unde...

pypi

No PRs yet

virtualenv: Bash prompt values can change meaning under older compatibility modes

GHSA-6w3r-xr62-4xcp CVE-2026-113723 HIGH 3 days ago

## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to ...

pypi

No PRs yet

virtualenv: Venv configuration readback can reinterpret path boundaries

GHSA-qmx5-4p3x-wvqf CVE-2026-113715 LOW 3 days ago

## Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's co...

pypi

No PRs yet

virtualenv: Seed replacement does not contain metadata deletion paths

GHSA-hhxq-47xx-j5xx CVE-2026-113719 MODERATE 3 days ago

## Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking c...

pypi

No PRs yet

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

GHSA-xcx6-jx8p-x3h5 CVE-2026-109461 HIGH 3 days ago

### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information ...

npm

No PRs yet

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

GHSA-xjj6-f33q-929c CVE-2026-109869 HIGH 3 days ago

### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and close...

npm

34

Dependabot PRs

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

GHSA-4qv8-2p9j-2685 CVE-2026-109924 MODERATE 3 days ago

### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending...

npm

27

Dependabot PRs

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

GHSA-f72v-6w45-q472 CVE-2026-109841 MODERATE 3 days ago

### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI...

npm

19

Dependabot PRs

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

GHSA-m5mm-p8h7-m29v CVE-2026-115897 LOW 3 days ago

### Impact `serialize-javascript` escapes its output so it is safe to embed inside a `<script>` element. Before 7.1.3 that guarantee did not hold ...

npm

5

Dependabot PRs

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

GHSA-q7qp-rjg7-q26m CVE-2026-113872 HIGH 3 days ago

### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted ...

npm

3

Dependabot PRs

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

GHSA-2wqp-q3c6-ccj5 CVE-2026-115886 MODERATE 3 days ago

### Summary MLflow's tracking server exposes `POST /ajax-api/3.0/mlflow/scorer/invoke` with **no authentication**, and the handler reflectively ins...

pypi

No PRs yet

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

GHSA-6hmw-9432-67qq CVE-2026-115883 MODERATE 3 days ago

### Summary The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `("tenant.bob",)` map to the...

pypi

No PRs yet

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

GHSA-834v-8h66-3h79 CVE-2026-115895 HIGH 3 days ago

## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaS...

npm

No PRs yet

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

GHSA-9pvw-hwfg-92h5 CVE-2026-115892 MODERATE 3 days ago

### Summary Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future...

cargo

No PRs yet

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

GHSA-897f-g5gm-fmxm CVE-2026-115889 CRITICAL 3 days ago

## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in...

cargo

No PRs yet

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

GHSA-2g95-wg33-c5x2 CVE-2026-112906 MODERATE 3 days ago

`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at `<path>`, whose presence says a process holds the lock) once a...

pypi

No PRs yet

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

GHSA-crv4-6mhj-j5jh CVE-2026-112914 MODERATE 3 days ago

When a soft-lock stale break finds that the marker (the lock file at `<path>`) it renamed aside was a live one recreated by a successor, the restor...

pypi

No PRs yet

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

GHSA-v4x8-3wr5-3wq8 CVE-2026-112940 HIGH 3 days ago

`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates...

pypi

No PRs yet

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

GHSA-h4fr-cmh5-qr62 LOW 3 days ago

### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob als...

cargo npm

No PRs yet

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

GHSA-jfwm-3p3c-6hx5 CVE-2026-115569 LOW 3 days ago

### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry ...

cargo npm

No PRs yet

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

GHSA-5x8w-8jj5-q52h CVE-2026-112398 CRITICAL 3 days ago

### Credits **Researcher**: Alex Bouffard (mixbo@pebwalker.com) ### Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder ...

pypi

No PRs yet