Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 7.8
    CVE-2025-14287 Command Injection in mlflow/mlflow
    pypibitnami
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  2. 3.6
    CVE-2026-32722 Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
    pypi
  3. —
    GHSA-5cxw-w2xg-2m8h fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
    pypi
  4. —
    GHSA-r48f-3986-4f9c fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
    pypi
  5. 7.5
    CVE-2026-105782 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
    pypi
  6. 7.5
    CVE-2026-31899 CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
    pypi
  7. 7.5
    CVE-2026-32640 (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.
    pypi
  8. 8.1
    CVE-2026-32116 Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
    pypi
  9. 8.1
    CVE-2026-32247 Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
    pypi
  10. 7.5
    CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
    pypi
  11. 7.7
    CVE-2026-21887 OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
    pypi
  12. 7.5
    CVE-2026-28356 ReDoS in multipart 1.3.0 - `parse_options_header()`
    pypi
  13. 7.8
    CVE-2026-3989 CVE-2026-3989
    pypi
  14. 9.8
    CVE-2026-3060 CVE-2026-3060
    pypi
    EPSS 1.3% chance of exploitation in 30 days, percentile 71%
  15. 9.8
    CVE-2026-3059 CVE-2026-3059
    pypi
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%
  16. 7.5
    CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name
    pypi
  17. 6.8
    CVE-2026-32112 ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
    pypi
  18. 5.3
    CVE-2026-32111 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
    pypi
  19. 3.7
    CVE-2026-32109 Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
    pypi
  20. 6.5
    CVE-2026-32108 Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
    pypi
  21. 7.2
    CVE-2026-35536 Tornado has incomplete validation of cookie attributes
    pypi
  22. 7.5
    CVE-2026-31958 Tornado has a DoS due to too many multipart parts
    pypi
  23. 5.3
    CVE-2026-31815 django-unicorn affected by component state manipulation via unvalidated attribute access
    pypi
  24. 9.1
    CVE-2026-27825 MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
    pypi
    EPSS 12.3% chance of exploitation in 30 days, percentile 96%
  25. 8.2
    CVE-2026-27826 MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
    pypi
    EPSS 13.9% chance of exploitation in 30 days, percentile 96%
  26. 8.8
    CVE-2026-26118 Azure MCP Server Tools Elevation of Privilege Vulnerability
    nugetnpmpypi
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  27. 4.6
    CVE-2026-30974 Copyparty volflag `nohtml` did not block javascript in svg files
    pypi
  28. 7.1
    CVE-2026-25960 SSRF Protection Bypass in vLLM
    pypi
  29. 9.8
    CVE-2026-30930 Glances has SQL Injection via Process Names in TimescaleDB Export
    pypi
  30. 7.5
    CVE-2026-30928 Glances Exposes Unauthenticated Configuration Secrets
    pypi
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%