https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:33:23 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-27199 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2026-27199 https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2026-27199 <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Werkzeug&#39;s `safe_join` function allows Windows device names as filenames if when preceded by other path segments.</p> <p>This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.</p> <p>`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Werkzeug&#39;s `safe_join` function allows Windows device names as filenames if when preceded by other path segments.</p> <p>This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.</p> <p>`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2026-27199 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0395 certfr-2026-avi-0395 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0395 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 https://cve.radiocsirt.org/vuln/euvd-2026-270469 EUVD-2026-270469 https://cve.radiocsirt.org/vuln/euvd-2026-270469 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27199 <p>Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.</p> <p>Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27199 https://cve.radiocsirt.org/vuln/ghsa-29vq-49wr-vm6x <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows Windows device names as filenames if when preceded by other path segments.</p> <p>This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.</p> <p>`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows Windows device names as filenames if when preceded by other path segments.</p> <p>This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.</p> <p>`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> https://cve.radiocsirt.org/vuln/ghsa-29vq-49wr-vm6x https://cve.radiocsirt.org/vuln/msrc_cve-2026-27199 msrc_CVE-2026-27199 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27199 https://cve.radiocsirt.org/vuln/pysec-2026-2320 <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2320 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933