Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-42085 OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames
    rubygemspypi
  2. 8.1
    CVE-2026-42084 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
    rubygemspypi
  3. 6.1
    CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
    pypi
  4. 8.8
    CVE-2026-6859 Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`
    pypi
  5. 7.1
    CVE-2026-6855 Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
    pypi
  6. 8.8
    CVE-2026-42215 GitPython: Command injection via Git options bypass
    pypi
  7. 8.1
    CVE-2026-42284 GitPython: Unsafe option check validates multi_options before shlex.split transforms it
    pypi
  8. 8.8
    CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
    pypi
  9. 8.8
    CVE-2026-42271 LiteLLM: Authenticated command execution via MCP stdio test endpoints
    pypi
    kev 1 public exploit EPSS 91.4% chance of exploitation in 30 days, percentile 99.8%
  10. 6.5
    CVE-2026-39378 nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
    pypi
  11. 6.5
    CVE-2026-39377 nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
    pypi
  12. 6.3
    CVE-2026-35588 Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
    pypi
  13. 8.8
    CVE-2026-35587 Glances IP Plugin has SSRF via public_api that leads to credential leakage
    pypi
  14. 6.5
    CVE-2026-34839 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
    pypi
  15. 9.8
    CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification
    pypi
    kev 1 public exploit EPSS 89.4% chance of exploitation in 30 days, percentile 99.7%
  16. 7.5
    CVE-2026-33626 LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
    pypi
    EPSS 45.3% chance of exploitation in 30 days, percentile 98%
  17. 8.8
    CVE-2026-42203 LiteLLM: Server-Side Template Injection in /prompts/test endpoint
    pypi
  18. 4.7
    CVE-2026-6550 Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
    pypi
  19. 4.6
    CVE-2026-3219 pip doesn't reject concatenated ZIP and tar archives
    pypi
  20. 5.3
    CVE-2025-66335 Apache Doris MCP Server: MCP SQL inject
    pypi
  21. 5.3
    CVE-2026-6608 lm-sys fastchat Arena Side-by-Side View add_text control flow
    pypi
  22. 5.3
    CVE-2026-6607 lm-sys fastchat Worker API Endpoint api_generate resource consumption
    pypi
  23. 7.3
    CVE-2026-6606 modelscope agentscope _agent_base.py _process_audio_block server-side request forgery
    pypi
  24. 7.3
    CVE-2026-6605 modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery
    pypi
  25. 7.3
    CVE-2026-6604 modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery
    pypi
  26. 7.3
    CVE-2026-6603 modelscope agentscope _python.py execute_shell_command code injection
    pypi
  27. 6.3
    CVE-2026-6599 langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection
    pypi
  28. 4.3
    CVE-2026-6598 langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file
    pypi
  29. 2.7
    CVE-2026-6597 langflow-ai langflow Flow Using API core.py has_api_terms credentials storage
    pypi
  30. 7.3
    CVE-2026-6596 langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload
    pypi