Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 10.0
    CVE-2026-25632 EPyT-Flow has unsafe JSON deserialization (__type__)
    pypi
  2. 2.7
    CVE-2026-25517 Wagtail has improper permission handling on admin preview endpoints
    pypi
  3. 9.8
    CVE-2025-64712 Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
    pypi
  4. 7.5
    CVE-2025-14550 Potential denial-of-service vulnerability via repeated headers when using ASGI
    Djangopypibitnami
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  5. 8.5
    CVE-2026-1312 Potential SQL injection via QuerySet.order_by and FilteredRelation
    Djangopypibitnami
  6. 8.3
    CVE-2026-1287 Potential SQL injection in column aliases via control characters
    Djangopypibitnami
  7. 7.5
    CVE-2026-1285 Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
    Djangopypibitnami
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  8. 8.3
    CVE-2026-1207 Potential SQL injection via raster lookups on PostGIS
    Djangopypibitnami
    EPSS 12.8% chance of exploitation in 30 days, percentile 96%
  9. 5.3
    CVE-2025-13473 Username enumeration through timing difference in mod_wsgi authentication handler
    Djangopypibitnami
  10. 8.4
    CVE-2025-70560 Boltz contains an insecure deserialization vulnerability in its molecule loading functionality
    pypi
  11. 9.8
    CVE-2026-25505 Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
    pypi
  12. 6.5
    CVE-2026-56304 picklescan - Arbitrary File Creation via logging.FileHandler Deserialization
    pypi
  13. 9.8
    CVE-2026-53874 picklescan - Arbitrary Code Execution via Obfuscated eval Call
    pypi
  14. 9.6
    CVE-2026-25481 Langroid has WAF Bypass Leading to RCE in TableChatAgent
    pypi
  15. 5.9
    CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations
    pypi
  16. 7.2
    CVE-2026-1777 Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk
    pypi
  17. 9.8
    CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
    pypi
    1 public exploit EPSS 18.3% chance of exploitation in 30 days, percentile 97%
  18. 5.4
    CVE-2025-69207 Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
    pypi
  19. 2.0
    CVE-2026-1703 Limited path traversal when installing wheel archives
    pypi
  20. 7.5
    CVE-2026-0599 Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference
    pypi
    EPSS 29.5% chance of exploitation in 30 days, percentile 98%
  21. 9.1
    CVE-2024-5986 Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3
    mavenpypi
  22. 5.3
    CVE-2025-6208 Uncontrolled Memory Consumption in run-llama/llama_index
    pypi
  23. 7.0
    CVE-2025-10279 Privilege Escalation in mlflow/mlflow
    pypibitnami
  24. 8.2
    CVE-2026-1117 Improper Access Control in parisneo/lollms
    pypi
  25. 5.4
    CVE-2025-70960 Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module
    pypi
  26. 5.4
    CVE-2025-70959 Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module
    pypi
  27. 5.4
    CVE-2020-37044 OpenCTI 3.3.1 - Cross Site Scripting
    pypi
  28. 7.5
    CVE-2020-37041 OpenCTI 3.3.1 - Directory Traversal
    pypi
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  29. 9.7
    CVE-2026-25130 Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool
    pypi
  30. 6.2
    CVE-2025-62349 Salt Master authentication protocol downgrade may enable minion impersonation
    pypi