Pylint versions from 0.15.2 up to but not including 4.0.9 have a vulnerability where module statistics are stored in predictable cache files and loaded using pickle.load. An attacker with write access to the cache directory can replace these files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by others. This issue is fixed in version 4.0.9.
draw.io Desktop versions prior to 31.4.4 contain a path traversal vulnerability allowing arbitrary local file disclosure. The issue arises because several Electron main process read-side IPC handlers operate on user-chosen filesystem paths without proper authorization checks, leading to a read/write authorization asymmetry. This vulnerability is fixed in version 31.4.4.
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
dnspython versions prior to 2.9.0 contain an uncontrolled recursion vulnerability in the dns.name.from_wire_parser function. This function follows DNS compression pointer chains without a hop limit, allowing a malicious DNS message to cause excessive pointer traversal. This can lead to high CPU usage, application degradation, or denial of service. The issue is fixed in dnspython version 2.9.0.
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
A vulnerability in graphql-core, a Python GraphQL implementation, allows unauthenticated remote attackers to cause uncontrolled resource consumption. The parser's max_tokens limit does not properly account for comment tokens, which are retained in memory despite being skipped, enabling memory exhaustion before other controls activate. This issue affects versions from 3.2.3 up to but not including 3.2.12, and from 3.3.0a3 up to but not including 3.3.0rc1. The vulnerability has a high severity with a CVSS score of 7.5 and is fixed in versions 3.2.12 and 3.3.0rc1.
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.
A memory-related vulnerability in an upstream library used by Next.js for Image Optimization can lead to unauthenticated remote code execution (RCE) when processing SVG files on glibc-based Linux systems. This affects Next.js versions from 10.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1. The vulnerability is critical and can be mitigated by upgrading the 'sharp' library to version 0.35.5 or later, which is included in patched Next.js releases.
Microsoft is retiring the Exchange Web Services (EWS) API in Exchange Online, which causes EWS-dependent applications to stop working when the API is disabled. IT administrators can temporarily re-enable EWS to restore functionality until the final shutdown on April 1, 2027. Microsoft recommends updating or replacing applications to use the Microsoft Graph API, which offers similar features. The retirement affects only Exchange Online and Microsoft 365 environments; on-premises Exchange Server installations remain unaffected.
CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server affecting versions 2026.3.5.0 through 2026.3.10.0 and all versions up to 2026.2.20.0. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers by sending a crafted import request to the PAM AD computer import endpoint.
PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from a symmetric oct JWK without raising an error. This allows an attacker to forge tokens by exploiting the verification process that uses this empty key, bypassing signature verification when the key is sourced from a JWK with an empty 'k' value. The issue affects verification paths using PyJWK, PyJWKSet, or PyJWKClient. The vulnerability requires no authentication but depends on the verifier trusting a JWKS containing an empty key entry, which can happen due to misconfiguration or unset environment variables. A fix is available.
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
CVE-2026-114486 is an incorrect authorization vulnerability in Devolutions Server affecting versions prior to 2026.3.11. It allows an authenticated non-administrative user to bypass Network Access Rules on a virtual gateway by exploiting the token generation process, enabling access to hosts that should be denied.
A vulnerability in Devolutions Server versions 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to access MFA secrets of all users via the user list API. This issue stems from insufficient protection of sensitive information in the user list endpoint.
crawlseo versions before 0.2.5 store Google OAuth access and refresh tokens in cleartext within the User.googleTokens database column. This vulnerability allows attackers who have read access to the Postgres database to obtain long-lived refresh tokens in plaintext. With these tokens, attackers can gain indefinite, unauthenticated access to all registered users' Google Search Console data. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
crawlseo versions before 0.2.4 have a server-side request forgery (SSRF) vulnerability in the crawler engine. The function isPrivateIp() does not block certain reserved IP ranges and fails to pin the validated address, allowing a time-of-check to time-of-use (TOCTOU) DNS rebinding bypass. An authenticated attacker can add malicious domains resolving to internal or restricted IPs, trigger crawls to access internal services or cloud metadata endpoints, and retrieve limited data such as page titles and status codes via the crawl results API. This enables internal network reconnaissance.
A resource exhaustion vulnerability exists in opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage when processing a malformed header with a long sequence of spaces or tabs. This can impact availability by consuming excessive CPU resources, potentially delaying or blocking other requests in synchronous or asynchronous environments. The vulnerability does not expose or modify telemetry data and does not allow code execution. The issue is fixed in version 1.45.1.
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is not possible.
Next.js versions from 13.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1, contain a vulnerability where crafted requests targeting App Router applications with Server Actions can cause excessive CPU usage and block further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.