https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:13:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09573 bdu:2026-09573 https://cve.radiocsirt.org/vuln/bdu:2026-09573 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34515 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>On Windows the static resource handler may expose information about a NTLMv2 remote path.</p> <p>### Impact</p> <p>If an application is running on Windows, and using aiohttp&#39;s static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user&#39;s credentials from there.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary</p> <p>On Windows the static resource handler may expose information about a NTLMv2 remote path.</p> <p>### Impact</p> <p>If an application is running on Windows, and using aiohttp&#39;s static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user&#39;s credentials from there.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-34515 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0550 certfr-2026-avi-0550 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0550 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-278794 EUVD-2026-278794 https://cve.radiocsirt.org/vuln/euvd-2026-278794 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34515 <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34515 https://cve.radiocsirt.org/vuln/ghsa-p998-jp59-783m <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>On Windows the static resource handler may expose information about a NTLMv2 remote path.</p> <p>### Impact</p> <p>If an application is running on Windows, and using aiohttp&#39;s static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user&#39;s credentials from there.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary</p> <p>On Windows the static resource handler may expose information about a NTLMv2 remote path.</p> <p>### Impact</p> <p>If an application is running on Windows, and using aiohttp&#39;s static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user&#39;s credentials from there.</p> <p>-----</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d</p> https://cve.radiocsirt.org/vuln/ghsa-p998-jp59-783m https://cve.radiocsirt.org/vuln/pysec-2026-2097 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2097 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34515 <p><strong>Affected:</strong> Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> <p><strong>Affected:</strong> Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34515 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933