WebOb: Open redirect in Location header normalization via leading C0 control / space characters

CVE-2026-54770

## Summary This is a third follow-up to **CVE-2024-42353 / GHSA-mg3v-6m49-jhp3** and **CVE-2026-44889 / GHSA-fh3h-vg37-

历史摘要 · 未重新核验 · GitHub Advisory

asyncssh has SCP Path Traversal to Arbitrary File Write

CVE-2026-54591

| | | |---|---| | Product | asyncssh (all versions through 2.23.0) | | Related | CVE-2019-6111 (same class in OpenSSH) |

历史摘要 · 未重新核验 · GitHub Advisory

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

CVE-2026-54590

**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The 2.23.0 guard that sanitises the SSH username before `

历史摘要 · 未重新核验 · GitHub Advisory

senaite.core Vulnerable to Eval Injection and Missing Authorization

CVE-2026-54569

### Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable

历史摘要 · 未重新核验 · GitHub Advisory

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

## Summary OpenWISP IPAM is multi-tenant: every `Subnet` belongs to an `organization`, and API access is scoped to the

历史摘要 · 未重新核验 · GitHub Advisory

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

## Summary The PyPI account that publishes `pantheon-agents` was compromised in the June 2026 "Hades" PyPI supply-chain

历史摘要 · 未重新核验 · GitHub Advisory

kas Persistently Disables SSH Host Key Checking

CVE-2026-54548

### Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is trigge

历史摘要 · 未重新核验 · GitHub Advisory

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

CVE-2026-54553

## Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search

历史摘要 · 未重新核验 · GitHub Advisory

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

CVE-2026-54338

### Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM

历史摘要 · 未重新核验 · GitHub Advisory

icalendar has Algorithmic Complexity in Equality

CVE-2026-55099

### Summary `Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser ac

历史摘要 · 未重新核验 · GitHub Advisory

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

CVE-2026-45019

### Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has bee

历史摘要 · 未重新核验 · GitHub Advisory

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

CVE-2026-45018

### Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has bee

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser vulnerable to DoS via deeply nested parens in Received headers

CVE-2026-55620

### Summary `eml_parser` strips parenthesised CFWS comments from `Received:` headers using a regex-based fix-point loop

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

CVE-2026-55619

### Summary `eml_parser` uses the `email.utils.getaddresses()` function from the CPython standard library to parse e-ma

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has a URL extraction bypass via HTML entities in URLs

CVE-2026-55618

## Summary `eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prio

历史摘要 · 未重新核验 · GitHub Advisory

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's pl

历史摘要 · 未重新核验 · GitHub Advisory

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

CVE-2026-55419

## Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file valid

历史摘要 · 未重新核验 · GitHub Advisory

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

CVE-2026-55585

### Summary The `qwed` package (version 5.1.1) passes attacker-controlled input directly to SymPy's `parse_expr()` func

历史摘要 · 未重新核验 · GitHub Advisory

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

CVE-2026-55571

### Impact djust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` / `p

历史摘要 · 未重新核验 · GitHub Advisory

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

CVE-2026-54625

### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The heade

历史摘要 · 未重新核验 · GitHub Advisory