Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. —
    PYSEC-2026-3 Two telnyx versions published containing credential harvesting malware
    pypi
  2. 8.8
    CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
    pypi
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  3. 3.1
    CVE-2026-29071 Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
    pypi
  4. 5.4
    CVE-2026-29070 Open WebUI has unauthorized deletion of knowledge files
    pypi
  5. 7.1
    CVE-2026-28788 Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
    pypi
    EPSS 3.0% chance of exploitation in 30 days, percentile 87%
  6. 4.3
    CVE-2026-28786 Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
    pypi
  7. 7.5
    GHSA-wcjx-v2wj-xg87 C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
    pypi
  8. 9.9
    CVE-2026-33873 Langflow has Authenticated Code Execution in Agentic Assistant Validation
    pypi
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  9. 7.5
    CVE-2026-34070 LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
    pypi
    EPSS 1.4% chance of exploitation in 30 days, percentile 73%
  10. 5.3
    CVE-2026-33936 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
    pypi
  11. 7.8
    CVE-2026-33744 BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
    pypi
  12. 5.3
    CVE-2026-34073 cryptography has incomplete DNS name constraint enforcement on peer names
    pypi
  13. 7.6
    CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler
    pypi
    EPSS 2.1% chance of exploitation in 30 days, percentile 81%
  14. 7.2
    CVE-2026-27602 Modoboa has an OS Command Injection
    pypi
  15. 4.4
    CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
    pypi
  16. —
    GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware
    pypi
  17. 8.8
    CVE-2025-70887 Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components
    pypi
  18. 7.8
    CVE-2026-24159 NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
    pypi
  19. 7.8
    CVE-2026-24157 NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
    pypi
  20. 5.3
    CVE-2026-33545 MobSF has SQL Injection in its SQLite Database Viewer Utils
    pypi
  21. 6.1
    CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout
    pypi
  22. —
    PYSEC-2026-2 Two litellm versions published containing credential harvesting malware
    pypi
  23. 4.7
    CVE-2026-33682 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)
    pypi
  24. 7.3
    CVE-2026-33430 Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions
    pypi
  25. 8.8
    CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
    pypi
  26. 7.5
    CVE-2026-33699 pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
    pypi
  27. —
    GHSA-x2xm-p98v-j3v7 Missing Release of Memory after Effective Lifetime in cbor2
    pypi unreviewed · maintainers only
  28. 7.5
    CVE-2026-26209 cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
    pypi
  29. 3.3
    CVE-2026-4539 pygments archetype.py AdlLexer redos
    pypi
  30. 5.3
    CVE-2026-4538 PyTorch pt2 Loading deserialization
    bitnamipypi