https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T17:24:29.996206+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-271161 EUVD-2026-271161 2026-10-08T17:24:29.998764+00:00 EUVD-2026-271161 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27941 fkie_cve-2026-27941 2026-10-08T17:24:29.998795+00:00

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

 https://cve.radiocsirt.org/vuln/pysec-2026-2246 PYSEC-2026-2246 2026-10-08T17:24:29.998828+00:00

Affected: PyPI: openlit

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.