JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
The extension allowlist/blocklist check inside `PyPIExtensionManager.install()` was not enforced due to a missing await.
#cwe-636
共收录 62 条相关情报。
← 返回所有主题SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to...
CVE-2026-53712
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security L
SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
CVE-2026-53712
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security L
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the...
CVE-2026-62235
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission ...
CVE-2026-62235
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al
Grav Flex-Objects < 1.4.3 Authorization Bypass via API
CVE-2026-62235
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50528
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with c...
CVE-2026-54291
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecur...
CVE-2026-53913
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerabili
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms
CVE-2026-53712
## Summary A flaw in `com.ongres.scram:scram-client` allows an attacker capable of performing a TLS man-in-the-middle (
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that cau...
CVE-2026-54762
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerabilit
Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
CVE-2026-54762
## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment
CVE-2026-53852
### Summary Empty-scope device re-pairing could confuse caller scope containment. In affected versions, a device re-pai
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing...
CVE-2026-53852
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticat
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by s...
CVE-2026-53852
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticat
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event...
CVE-2026-53837
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to va
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intend...
CVE-2026-53837
CVE-2026-53837 是 OpenClaw 组件中的一个不当访问控制漏洞，影响版本早于 2026.5.6。该漏洞源于 Mattermost 事件处理器未能正确验证频道类型元数据，导致攻击者可以通过发送缺少频道类型信息的恶意 Matt
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass t...
CVE-2026-49318
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 m
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass t...
CVE-2026-49317
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 m
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstre...
CVE-2026-45781
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI