MLflow versions from 2.19.0 up to but not including 3.17.0 contain a vulnerability where the mlflow.crewai.autolog() function records CrewAI Agent objects without properly sanitizing nested credential values. This causes provider API keys to be included in plaintext within trace data sent to MLflow's trace backend or OTLP destinations. The issue is resolved in version 3.17.0.
fpdf2 contains a vulnerability where nested SVG <use> references cause exponential growth in memory and CPU usage during image processing. This occurs because fpdf2 deep-copies referenced SVG objects recursively, leading to resource exhaustion. A crafted SVG under 1 KB can cause the process to consume excessive memory and CPU, resulting in a MemoryError and denial of service in PDF generation workflows.
The pdfly library (fpdf2) implicitly dereferences image resource references when rendering content, which can lead to outbound HTTP(S) requests or local file access attempts if untrusted input is processed. This affects applications that render untrusted HTML, SVG, or image paths without sanitization. The issue can enable Server-Side Request Forgery (SSRF) and limited local file access depending on the image parsing success. A fix is available in version 0.5.1_25.
Sunhillo SureLine versions prior to 9.1.5 have an authentication bypass vulnerability due to reliance on session cookies that lack validation and integrity checking. An unauthenticated remote attacker can forge a session cookie containing only a cleartext username, such as default accounts like Admin or sftp_user, to impersonate any user with an active web session. This flaw allows attackers to bypass login checks and potentially execute root commands. The vulnerability is fixed in version 9.1.5.
Sunhillo SureLine versions from 8.6.0 up to but not including 9.1.5 contain an OS command injection vulnerability in the networkDiag.cgi endpoint. This flaw allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. The vulnerability arises because attackers can bypass a prior character denylist by using URL-encoded newline (%0a) or ampersand (%26) sequences, which act as command separators after decoding in diagnostic modes such as ping, nslookup, or traceroute. The issue is fixed in version 9.1.5.
Sunhillo SureLine versions prior to 9.1.5 contain a path traversal vulnerability in the radarUpdater.cgi endpoint. This flaw allows unauthenticated remote attackers to read arbitrary files with root privileges by exploiting insufficient sanitization of the filename parameter and lack of authentication checks. Sensitive files such as /etc/shadow, the web user database, root SSH private key, and TLS private key can be accessed, potentially leading to full system compromise. The vulnerability is fixed in version 9.1.5.
MLflow versions from 3.10.0 up to but not including 3.17.0 contain a path traversal vulnerability in the _create_model_version() function. This flaw allows remote attackers to read arbitrary files on the MLflow server by storing a server-local path as the model version artifact location and accessing it via the model-versions API. Unauthenticated servers are fully exposed, while basic-auth servers expose this to authenticated users who can create registered models. The issue is resolved in version 3.17.0.
A vulnerability in the follow-redirects Node.js library versions 1.16.0 through 1.16.1 allows sensitive headers to be improperly forwarded during cross-origin redirects. This occurs because the sensitiveHeaders option is checked using value instanceof Array, which fails for arrays created in different JavaScript realms, causing the sensitive headers list to be replaced with an empty array. As a result, custom credential headers can be sent to attacker-controlled redirect destinations. The issue is fixed in version 1.16.2.
CKEditor 5 versions from 45.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability due to prototype pollution in a vulnerable es-toolkit version used by the editor engine. This flaw allows crafted editor content to execute unauthorized JavaScript in the browser. The issue is resolved in versions 47.7.4 and 48.5.1.
OAuthLib versions from 4.5.1_3 up to but not including 4.5.1_14 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation and mishandles public clients. A fix is available in version 4.5.1_14.
CKEditor 5 versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability when General HTML Support is enabled and configured to allow object content. This vulnerability allows specially crafted markup to execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin. The issue is fixed in versions 47.7.4 and 48.5.1.
A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications using dnspython for DNS name decompression. The issue affects FastAPI versions from 0.111.0 up to but not including 0.143.1. The vulnerability is fixed in dnspython 2.9.0 and FastAPI 0.143.1. No workarounds are known.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Model Context Protocol Python SDK versions from 1.10.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. The vulnerability arises because certain client calls validate server-declared outputSchema documents using jsonschema's default resolver, which can cause unresolved $ref values to fetch URLs or files from the client's network or filesystem. This can lead to blind requests, local file reads, and session stalls due to synchronous resolution without timeouts. The issue is fixed in versions 1.30.0 and 2.2.0.
A command injection vulnerability exists in the bash activation script of virtualenv when the shell option 'promptvars' is off at activation time. The bash activator inserts the user-supplied --prompt value into PS1 without escaping special characters, allowing subsequent re-enabling of prompt expansion to execute arbitrary commands embedded in the prompt. This regression was introduced in version 21.14.9 and persists in 21.14.12. The vulnerability allows an attacker controlling the prompt value to execute commands as the user who activates the virtual environment.
CVE-2026-113723 is a vulnerability in virtualenv's bash activation prompt handling where attacker-controlled prompt text can be interpreted as executable shell syntax under certain older bash compatibility modes (4.2 and lower) or when using dash shell. This can lead to command execution when the environment is activated and the prompt is drawn. The issue arises because the prompt string assigned to PS1 is expanded twice by the shell, and some code paths do not properly escape or sanitize the prompt text. The vulnerability affects virtualenv versions from 1.2.0 up to but not including 1.6.2 and 1.9.3 up to but not including 1.18.1_2. A fix is available in versions 1.6.2 and 1.18.1_2.
Virtualenv versions prior to 1.6.2 and 1.18.1_2 have a file permission issue where files copied from a cached app-data directory retain their original permissions, potentially allowing wider access than intended. This occurs because shutil.copy preserves cached file modes regardless of the current umask, leading to files with overly permissive modes in new environments. An attacker with access to the new environment and the ability to traverse it can exploit this to modify files such as pip/__init__.py, which then run with the environment owner's privileges.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder where the removal of previously installed seed packages does not properly validate deletion paths. This allows deletion of files outside the intended environment if malicious distribution metadata is present. The flaw occurs during environment creation when reusing an existing environment containing manipulated package metadata. The issue was introduced in version 20.8.1 and fixed in versions 1.6.2 and 1.18.1_2 of the affected product. Exploitation requires attacker-controlled metadata and deletion rights by the invoking user. The CVSS score is 4.5 (medium severity).
A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permissions in the directory containing the lock database to exploit SQLite's behavior of reopening lock files by name, following symlinks and acting on side files like -journal, -wal, and -shm. This can lead to the attacker writing arbitrary data into the lock user's files, creating or unlinking files, or causing lock acquisition failures. The issue affects filelock versions 3.20.4 through 4.2.0, with fixes available in version 1.18.1_2. The vulnerability requires specific directory permissions (non-sticky, writable by the attacker) and local access. It has a CVSS 3.1 score of 7.1 (High) with no confidentiality impact but high integrity and availability impacts.