changedetection.io project has an XXE vulnerability
CVE-2026-41895
# changedetection.io_XXE_01 Vulnerability Report: We discovered a XXE vulnerability in the changedetection.io project W
#pip
共收录 834 条相关情报。
← 返回所有主题Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
CVE-2026-42311
### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrar
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
CVE-2026-42310
### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and m
Pillow has an integer overflow when processing fonts
CVE-2026-42308
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may
Pillow has a heap buffer overflow with nested list coordinates
CVE-2026-42309
Passing nested lists as coordinates to APIs that accept coordinates such as `ImagePath.Path`, `ImageDraw.ImageDraw.polyg
pyp2spec is Vulnerable to Code Injection
CVE-2026-42301
### Impact pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without esca
Sentry's improper authentication on SAML SSO process allows user identity linking
CVE-2026-42354
### Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via S
CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CVE-2026-42032
### Impact A vulnerability in `datastore_search_sql` allowed attackers to bypass authorization in order to gain access
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
CVE-2026-41654
### Impact An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding
Weblate Doesn't Invalidate API Token on Password Change
CVE-2026-41519
### Impact When a user changes their password, browser sessions are correctly invalidated via `cycle_session_keys()`, bu
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
CVE-2026-40171
### Impact A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authenticati
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42031
### Impact A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
CVE-2026-42352
### Impact OGC API - Process execution requests can use the `subscriber` object to requests to internal HTTP services.
pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
CVE-2026-42351
### Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requ