Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2026-74889 openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
    pypi
  2. 7.5
    CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation
    pypi
  3. 5.5
    CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable
    pypi
  4. 9.8
    CVE-2026-74901 openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback
    pypi
  5. 9.8
    CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode
    pypi
  6. 9.8
    CVE-2026-74899 openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy
    pypi
  7. 9.8
    CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
    pypi
  8. 9.8
    CVE-2026-74896 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal
    pypi
  9. 9.8
    CVE-2026-74894 openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
    pypi
  10. 8.8
    CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets
    pypi
  11. 7.5
    CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key
    pypi
  12. 9.8
    CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials
    pypi
  13. 5.8
    CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
    pypinpm
  14. 6.5
    CVE-2026-25480 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
    pypi
  15. 6.5
    CVE-2026-25479 Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
    pypi
  16. 7.4
    CVE-2026-25478 Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
    pypi
  17. 6.5
    CVE-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass
    pypibitnami
  18. 6.5
    CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
    pypibitnami
  19. 5.8
    CVE-2026-25905 Lack of isolation in mcp-run-python leads to MCP server takeover
    pypi
  20. 5.8
    CVE-2026-25904 Overly permissive Deno configuration in mcp-run-python leads to SSRF
    pypi
  21. —
    GHSA-4f84-67cv-qrv3 A single post-release of dydx-v4-client contained obfuscated multi-stage loader
    pypi
  22. 9.4
    CVE-2026-1709 Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
    pypi
    EPSS 5.7% chance of exploitation in 30 days, percentile 93%
  23. 7.5
    CVE-2026-25650 MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token
    pypi
  24. 10.0
    CVE-2026-25592 Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
    pypinuget
    EPSS 2.5% chance of exploitation in 30 days, percentile 85%
  25. 8.6
    CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
    pypi
  26. 7.1
    CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
    pypi
  27. 7.5
    CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
    pypi
    1 public exploit EPSS 3.4% chance of exploitation in 30 days, percentile 88%
  28. 6.1
    CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
    pypi
  29. 7.4
    CVE-2026-1707 Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)
    pypi
  30. 4.7
    CVE-2026-25198 web2py has an Open Redirect Vulnerability
    pypi