35178: django-anymail <1.4 resolved (0.7 installed)!
In django-anymail before 1.4 the webhook validation was vulnerable to a timing attack. An attacker could have used this to obtain the WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to the app.

35198: django-anymail >=0.2,<1.4 resolved (0.7 installed)!
In django-anymail v0.2–v1.3 the WEBHOOK_AUTHORIZATION key might get leaked if DEBUG=True since it isn’t sanitized properly.

35034: django-allauth <0.34.0 resolved (0.30.0 installed)!
On django-allauth before 0.34.0 the "Set Password" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.