https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T22:57:08.869706+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-8862 CVE-2024-8862 — h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization 2026-10-20T22:57:08.871452+00:00

Affected: h2oai h2o-3

A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

 https://cve.radiocsirt.org/vuln/pysec-2026-1321 PYSEC-2026-1321 — D-Tale Command Execution Vulnerability 2026-10-20T22:57:08.871507+00:00

Affected: PyPI: dtale

D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<data_id>"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is `python`, which allows executing the query expression ans leading to a command execution vulnerability.