Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 8.8
    CVE-2026-33175 OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims
    pypi
  2. 8.8
    CVE-2026-35029 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
    pypi
    EPSS 38.6% chance of exploitation in 30 days, percentile 98%
  3. 9.1
    CVE-2026-35030 LiteLLM has an authentication bypass via OIDC userinfo cache key collision
    pypi
  4. 9.1
    CVE-2026-0545 Missing Authentication for Critical Function in mlflow/mlflow
    pypi
    EPSS 4.4% chance of exploitation in 30 days, percentile 91%
  5. 6.5
    CVE-2026-34756 vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
    pypi
  6. 8.6
    CVE-2026-33752 Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)
    pypi
  7. 8.6
    CVE-2026-5463 pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()
    pypi
    EPSS 2.2% chance of exploitation in 30 days, percentile 82%
  8. 6.5
    CVE-2026-35175 Ajenti has an authorization bypass during custom package installation
    pypi
  9. 9.8
    CVE-2026-35171 Arbitrary Code Execution via Malicious Logging Configuration in Kedro
    pypi
  10. 7.1
    CVE-2026-35167 Kedro has a path traversal in versioned dataset loading via unsanitized version string
    pypi
  11. 9.8
    CVE-2026-35052 D-Tale affected by Remote Code Execution through redis/shelf storage
    pypi
  12. 5.9
    CVE-2026-34760 vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models
    pypi
  13. 9.8
    CVE-2026-35002 Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution
    pypi
  14. 9.1
    CVE-2026-34953 PraisonAI: Authentication Bypass in OAuthManager.validate_token()
    pypi
  15. 9.1
    CVE-2026-34952 PraisonAI: Missing Authentication in WebSocket Gateway
    pypi
  16. 8.6
    CVE-2026-34954 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
    pypi
  17. 8.8
    CVE-2026-34955 PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
    pypi
  18. 7.7
    CVE-2026-34936 PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
    pypi
  19. 6.5
    CVE-2026-34939 PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
    pypi
  20. 9.8
    CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
    pypi
  21. 9.8
    CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
    pypi
  22. 7.8
    CVE-2026-34937 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
    pypi
  23. 10.0
    CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
    pypi
    EPSS 13.4% chance of exploitation in 30 days, percentile 96%
  24. 5.5
    CVE-2026-34730 Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode
    pypi
  25. 4.4
    CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal
    pypi
  26. 6.5
    CVE-2026-74881 openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins
    pypi
  27. 9.8
    CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
    pypi
  28. 7.5
    CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint
    pypi
  29. 8.8
    CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key
    pypi
  30. 9.8
    CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption
    pypi