Threats affecting pkg:bitnami/python

Blossom versions up to 1.17.1 have an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService only filters queries by folder ID, enabling attackers to supply another user's folder ID to endpoints such as /folder/info, /folder/upd, /folder/open, or /folder/del. Exploitation can lead to unauthorized reading of storage paths, renaming, toggling visibility, or deletion of folders.

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

CoreShop by CoreUnion versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw arises from improper neutralization of special elements in the 'order' parameter used in an ORDER BY clause, allowing anonymous attackers to inject subqueries. Exploitation can lead to extraction of member accounts and orders via boolean-based or time-based blind SQL injection techniques.

CoreShop versions up to 1.5.5 have an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint. The flaw arises from improper validation of the 'order' parameter used in the ORDER BY clause, allowing attackers to inject subqueries. This can lead to extraction of sensitive data such as member accounts and orders using blind SQL injection techniques.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server versions up to 3.0.7 have an authorization bypass vulnerability in the FeedController.delFeed function. Authenticated users can delete moments belonging to other users by providing arbitrary feedId values in POST requests to /feed/del. This allows attackers to remove other users' moments, including associated media, comments, and likes.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Tencent BlueKing CMDB (bk-cmdb) versions up to 3.14.6 have a missing authorization vulnerability that allows authenticated users to access host information from other businesses. This occurs via the POST /api/v3/hosts/search/asstdetail endpoint, which improperly skips authorization checks, enabling unauthorized host data retrieval.

RuoYi-Vue-Plus versions up to 6.0.0 have an authorization bypass vulnerability in the SysUserServiceImpl.selectUserListByDept function. Authenticated users with the system:user:list permission under a department-restricted role can access user information from any department by specifying arbitrary department IDs. This allows them to retrieve usernames, nicknames, account status, last login IP and time, and remarks of users outside their authorized scope.

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

Blossom Editor versions up to 1.17.1 have an authorization bypass vulnerability allowing authenticated users with non-readonly privileges to manipulate other users' pictures by specifying arbitrary picture IDs. This flaw enables attackers to delete images or change their star status via specific endpoints.

CVE-2026-119680 is a stored cross-site scripting (XSS) vulnerability in ManageEngine SharePoint Manager Plus affecting the chart feature. It arises from improper sanitization and HTML encoding of user-controlled data such as users' full names, site names, or group names. Malicious HTML or JavaScript injected by an attacker is stored and executed in other users' browsers when viewing affected charts. The vulnerability has been fixed in client application build 4508.

Cisco has addressed a serious vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The vulnerability details, including affected versions and technical specifics, are not provided in the available information.

CVE-2026-100355 is a server-side request forgery (SSRF) vulnerability in the basecamp once-campfire web-based chat application versions 1.4.4 and earlier. The vulnerability arises because the server fetches URLs in messages to generate OpenGraph previews, but the IP address filtering mechanism does not cover certain special-use IP ranges. This allows an authenticated user to bypass restrictions and cause the server to make requests to internal network resources. The confidentiality impact is limited to the OpenGraph metadata returned, with no integrity or availability impact. The issue was fixed in version 1.4.5.

Red Hat Ansible Automation Platform 2.4 includes a security fix for an out-of-bounds write vulnerability in the Google Brotli decoder library used by python3.12-brotli (CVE-2026-111497). This vulnerability could potentially lead to memory corruption. Red Hat has issued an update for Ansible Automation Platform 2.4 on RHEL 8 and 9 architectures to address this issue.