deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8x34-9q3v-h7g8
Package: apache-airflow (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 3.0.0, < 3.1.8
Patched in: 3.1.8

Summary: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Details:
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
GitHub Security Advisory: GHSA-4fhm-p86v-hwpx
Package: apache-airflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 3.0.0, < 3.1.8
Patched in: 3.1.8

Summary: Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Details:
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
GitHub Security Advisory: GHSA-x3fv-96qh-67m7
Package: apache-airflow (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 3.0.0, < 3.1.8
Patched in: 3.1.8

Summary: Apache Airflow: DAG authorization bypass

Details:
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
GitHub Security Advisory: GHSA-4m3h-wp5w-5hqh
Package: apache-airflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 3.0.0, < 3.1.8
Patched in: 3.1.8

Summary: Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Details:
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
GitHub Security Advisory: GHSA-qpxp-75px-xjcp
Package: pypdf (PIP)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: < 6.9.1
Patched in: 6.9.1

Summary: pypdf has inefficient decoding of array-based streams

Details:
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and/or large memory usage. This requires accessing an array-based stream with lots of entries.

### Patches
This has been fixed in [pypdf==6.9.1](https://github.com/py-pdf/pypdf/releases/tag/6.9.1).

### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3686](https://github.com/py-pdf/pypdf/pull/3686).
GitHub Security Advisory: GHSA-vg28-83rp-8xx4
Package: frigate (PIP)
Severity: HIGH (CVSS 7.1)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 0.16.3
Patched in: unpatched

Summary: Frigte has broken access control viewer user can delete admin and other users account

Details:
### Summary
Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.

### Details
Endpoint `DELETE /api/users/admin` is enable to anonymous user.

<img width="436" height="100" alt="obraz" src="https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229" />

### PoC
I deleted admin user on `demo.frigate.video`:

<img width="1091" height="222" alt="obraz" src="https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915" />


### Impact
It this leads to denial of service and affects data integrity.

### Recommended Fixes
Restrict access to the endpoint to authenticated admin users only:
Add `dependencies=[Depends(require_role(["admin"]))])` to this endpoint.
GitHub Security Advisory: GHSA-c8rr-9gxc-jprv
Package: ujson (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound, CWE-787: Out-of-bounds Write, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: >= 5.1.0, <= 5.11.0
Patched in: 5.12.0

Summary: UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

Details:
### Summary

`ujson.dumps()` crashes the Python interpreter (segmentation fault) when the product of the `indent` parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the `indent` is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service.

(Note: A negative indent to `ujson` means add spaces after colons but do not add line breaks or indentation. It is unclear to the current maintainers whether this was ever even an intended feature or just a byproduct of the way it was written.)

### Exploitability

To be vulnerable, a service must call `ujson.dump()`/`ujson.dumps()`/`ujson.encode()` whilst giving untrusted users control over the `indent` parameter and not restrict that indentation to reasonably small non-negative values. (Even with the fix for this vulnerability, such usage is strongly advised against since even a bug-free JSON serialiser would be vulnerable to denial of service simply by the attacker requesting indents that have the server needlessly filling out gigabytes of whitespace.)

A service may also be vulnerable to the infinite loop if it uses a fixed _negative_ `indent`. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. As far as the maintainers are aware, the infinite loop can not be reached for indentations from -1 to -65536 / max_recursion_depth_as_limited_by_stack_size but users of negative indents are encouraged to consider their service affected even if the infinite loop seems unreachable.

### Example

```python
import ujson

def example(depth, indent):
    a = [0]
    for i in range(1000):
        a = [a]
    ujson.dumps(a, indent=indent)

example(1, 2**30)  # segfault
example(1000, -200)  # infinite loop
```

### Patches

ujson 5.12.0, containing 486bd4553dc471a1de11613bc7347a6b318e37ea, promotes the integer types where the overflow occurred, skips the indentation code path for negative indent (which was supposed to be a no-op) and places an artificial cap of 1000 on the `indent` parameter.

### Workarounds

Users who don't wish to upgrade can either use a fixed indentation, no indentation or ensure indentation is non-negative and not enormous (below `2**31 / max_recursion_depth_as_limited_by_stack_size`).

### References

The original bug report can be found at https://github.com/ultrajson/ultrajson/issues/700

This issue was independently discovered by @coco1629, @EthanKim88 and @vmfunc.
GitHub Security Advisory: GHSA-wgvc-ghv9-3pmm
Package: ujson (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 5.4.0, <= 5.11.0
Patched in: 5.12.0

Summary: UltraJSON has a Memory Leak parsing large integers allows DoS 

Details:
#### Summary

ujson 5.4.0 to 5.11.0 inclusive contain an accumulating memory leak in JSON parsing _large_ (outside of the range [-2^63, 2^64 - 1]) integers.

#### Exploitability

Any service that calls `ujson.load()`/`ujson.loads()`/`ujson.decode()` on untrusted inputs is affected and vulnerable to denial of service attacks.

#### Details

The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than `sys.get_int_max_str_digits()` digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload.

```python
ujson.loads(str(2 ** 64 - 1))  # No leak
ujson.loads(str(2 ** 64))  # Leaks
ujson.loads(str(10 ** sys.get_int_max_str_digits()))  # Leaks and raises ValueError
```

#### Fix

The leak is fixed in `ujson 5.12.0` (4baeb950df780092bd3c89fc702a868e99a3a1d2). There are no workarounds beyond upgrading to an unaffected version.

#### Credits

Discovered by Cameron Criswell/Skevros using Coverage-guided fuzzing (libFuzzer + AddressSanitizer)
GitHub Security Advisory: GHSA-rf6x-r45m-xv3w
Package: langflow (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 1.7.2
Patched in: 1.7.2

Summary: Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

Details:
**Detection Method:** Kolega.dev Deep Code Scan

| Attribute | Value |
|---|---|
| Location | src/backend/base/langflow/api/v1/api_key.py:44-53 |
| Practical Exploitability | High |
| Developer Approver | faizan@kolega.ai |

### Description
The delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

### Affected Code
```
@router.delete("/{api_key_id}", dependencies=[Depends(auth_utils.get_current_active_user)])
async def delete_api_key_route(
    api_key_id: UUID,
    db: DbSession,
):
    try:
        await delete_api_key(db, api_key_id)
    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e)) from e
    return {"detail": "API Key deleted"}
```

### Evidence
In crud.py lines 44-49, delete_api_key() retrieves the API key by ID and deletes it without checking if the key belongs to the authenticated user. The endpoint also doesn't pass the current_user to the delete function for verification.

### Impact
An authenticated attacker can enumerate and delete API keys belonging to other users by guessing or discovering their API key IDs. This allows account takeover, denial of service, and disruption of other users' integrations.

### Recommendation
Modify the delete_api_key endpoint and function: (1) Pass current_user to the delete function; (2) In delete_api_key(), verify api_key.user_id == current_user.id before deletion; (3) Raise a 403 Forbidden error if the user doesn't own the key. Example: if api_key.user_id != user_id: raise HTTPException(status_code=403, detail='Unauthorized')

### Notes
Confirmed IDOR vulnerability. The delete_api_key_route endpoint at line 44-53 accepts an api_key_id and calls delete_api_key(db, api_key_id) without passing the current_user. The CRUD function delete_api_key() at crud.py:44-49 retrieves the API key by ID and deletes it without verifying ownership (api_key.user_id == current_user.id). Compare this to the GET endpoint at lines 17-28 which correctly filters by user_id, and the POST endpoint at lines 31-41 which correctly associates the key with user_id. An authenticated attacker can delete any user's API keys by guessing/enumerating UUIDs. Fix: Pass current_user to delete_api_key and verify api_key.user_id == current_user.id before deletion, returning 403 if unauthorized.

### Developer Review Notes
Does not accept current_user as a parameter. Allowing deletion of any user's API keys even without permissions.
GitHub Security Advisory: GHSA-xfhr-q72q-jcrj
Package: bedrock-agentcore-starter-toolkit (PIP)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-283: Unverified Ownership, CWE-340: Generation of Predictable Numbers or Identifiers
Vulnerable versions: < 0.1.13
Patched in: 0.1.13

Summary: Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Details:
## Summary
An issue has been identified in the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 that may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime.


## Impact
A remote actor could inject code during the build process, leading to code execution in the AgentCore Runtime and a complete loss of confidentiality, integrity, and availability of the affected AgentCore resource.

Impacted versions:  All versions of Bedrock AgentCore Starter Toolkit versions before v0.1.13. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who build the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users on previous versions who built the toolkit before September 24, 2025 date are not affected. 

## Patches
This issue has been addressed in version v0.1.13. AWS recommends upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

## Workarounds
N/A

## References
If you have any questions or comments about this advisory, contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
GitHub Security Advisory: GHSA-2cpp-j2fc-qhp7
Package: awslabs.aws-api-mcp-server (PIP)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-424: Improper Protection of Alternate Path
Vulnerable versions: >= 0.2.14, < 1.3.9
Patched in: 1.3.9

Summary: AWS API MCP File Access Restriction Bypass

Details:
### Description

The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls.

This server acts as a bridge between AI assistants and AWS services, allowing you to create, update, and manage AWS resources across all available services. The server includes a configurable file access feature that controls how AWS CLI commands interact with the local file system. By default, file operations are restricted to a designated working directory (workdir), but this can be configured to allow unrestricted file system access (unrestricted) or to block all local file path arguments entirely (no-access).

**Description:** Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context.

To remediate this issue, users should upgrade to version 1.3.9.
GitHub Security Advisory: GHSA-6mj8-jmp2-g8q7
Package: vanna (PIP)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Vanna has a SQL injection in the remove_training_data function

Details:
A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-q2r8-vmq7-fpx2
Package: mlflow (PIP)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 3.8.0rc0
Patched in: 3.8.0rc0

Summary: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

Details:
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account.
GitHub Security Advisory: GHSA-gq3w-7jj3-x7gr
Package: mlflow (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1393: Use of Default Password
Vulnerable versions: < 3.8.0rc0
Patched in: 3.8.0rc0

Summary: MLflow Use of Default Password Authentication Bypass Vulnerability

Details:
This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.
GitHub Security Advisory: GHSA-xch3-2f9x-wh9f
Package: mlflow (PIP)
Severity: HIGH (CVSS 7.5)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 3.8.0rc0
Patched in: 3.8.0rc0

Summary: MLflow has a command injection in mlflow/sagemaker/__init__.py

Details:
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
GitHub Security Advisory: GHSA-r5pr-887v-m2w9
Package: memray (PIP)
Severity: LOW (CVSS 3.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.19.2
Patched in: 1.19.2

Summary: Stored XSS in Memray-generated HTML reports via unescaped command-line metadata

Details:
## Summary

Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report.

This allowed JavaScript execution when a victim opened the generated report in a browser.

## Affected Version

- Memray version: `1.19.1` and earlier

## Remediation

Upgrade to Memray 1.19.2, and avoid attaching Memray to untrusted processes until you have upgraded.

## Root Cause

Jinja is used to embed the process's command line arguments into the generated flame graph or table report. Memray has not been telling Jinja to HTML escape the command line arguments when writing them into the HTML, leading to a stored XSS vulnerability.

## Impact

An attacker who can influence the script name or command-line arguments of a profiled program can inject HTML/JavaScript into Memray-generated HTML reports (both `memray flamegraph` and `memray table` reports, both with and without `--no-web`). When a victim opens the generated report in a browser, the injected JavaScript executes in the context of the report.

Note that in the case of `memray attach`, the user attaching Memray and generating the report may be a different user than the one who ran the command and set up the command line arguments.

## Proof of Concept

Run Memray on a script with an attacker-controlled filename:

```bash
touch '<img src=x onerror=alert(1)>'
python -m memray run -o poc.bin '<img src=x onerror=alert(1)>'
```

Generate a report:

```bash
python -m memray flamegraph -o poc.html poc.bin
```

## Observed Result

The generated HTML contains raw unescaped attacker-controlled HTML.

Opening or reloading the generated report in a browser triggers JavaScript execution.
GitHub Security Advisory: GHSA-5pwr-322w-8jr4
Package: pyopenssl (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: >= 22.0.0, < 26.0.0
Patched in: 26.0.0

Summary: pyOpenSSL DTLS cookie callback buffer overflow

Details:
If a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer.

Cookie values that are too long are now rejected.
GitHub Security Advisory: GHSA-vp96-hxj8-p424
Package: pyopenssl (PIP)
Severity: LOW (CVSS 0.0)
CWE: CWE-636: Not Failing Securely ('Failing Open')
Vulnerable versions: >= 0.14.0, < 26.0.0
Patched in: 26.0.0

Summary: pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

Details:
If a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it.

Unhandled exceptions now result in rejecting the connection.

Credit to **Leury Castillo** for reporting this issue.
GitHub Security Advisory: GHSA-44vg-5wv2-h2hg
Package: simpleeval (PIP)
Severity: HIGH (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 1.0.5
Patched in: 1.0.5

Summary: SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

Details:
### Impact
If the objects passed in as `names` to SimpleEval have modules or other disallowed / dangerous objects available as attrs.
Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.

Examples (found by @ByamB4):

Any module where non-underscore attribute chains reach os or sys:
- os.path, pathlib, shutil, glob (direct .os / .sys attributes)
- statistics (has .sys)
- numpy (has .ctypeslib.os and .f2py.sys)
- urllib.parse (has .warnings.sys)

### Patches
The latest version 1.0.5 has this issue fixed.

### Workarounds
Don't pass in objects or modules which have direct attributes to potentially dangerous items.
Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)