Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 5.4
    CVE-2026-50221 OpenStack Swift vulnerable to authenticated server-side request forgery
    pypi
  2. 5.4
    CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
    pypi
  3. 6.5
    CVE-2026-56695 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
    pypi
  4. 7.5
    CVE-2026-59935 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
    pypi
  5. 7.5
    CVE-2026-59936 pypdf: Possible infinite loop for not terminated inline images
    pypi
  6. 5.3
    CVE-2026-48487 Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
    pypi
  7. 8.8
    CVE-2026-54232 vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
    pypi
  8. 5.3
    CVE-2026-46611 Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
    pypi
  9. 7.4
    CVE-2026-46608 Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
    pypi
  10. 7.8
    CVE-2026-46607 Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution
    pypi
  11. 7.8
    CVE-2026-46606 Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
    pypi
  12. 9.1
    CVE-2026-46488 motionEye: Authentication possible via password hash
    pypi
  13. 5.5
    CVE-2026-32315 motionEye: World-Readable Configuration File Exposes Admin Password Hash
    pypi
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  14. 6.5
    CVE-2026-31978 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
    pypi
  15. 6.1
    CVE-2026-12479 Path Traversal in keras-team/keras
    pypi
  16. 7.5
    CVE-2026-59937 pypdf: Possible long runtimes for repeated malformed cross-reference entries
    pypi
  17. 5.3
    CVE-2026-59938 pypdf: Possible large memory usage for wrong image dimensions
    pypi
  18. 8.2
    CVE-2026-56104 Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration
    pypi
  19. 10.0
    CVE-2026-10561 Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
    pypi
  20. 8.1
    CVE-2025-66336 Apache Doris MCP Server: SQL injection leading the authentication bypass
    pypi
  21. 8.3
    CVE-2026-55830 RestrictedPython guard hooks can be shadowed via positional-only arguments
    pypi
  22. 5.9
    CVE-2026-59924 Mistune: Arbitrary File Read via Include directive path traversal
    pypi
  23. 7.5
    CVE-2026-115355 Mistune before 3.3.0 Path Traversal and XSS via Include Directive
    pypi
  24. 6.1
    CVE-2026-59926 Mistune: XSS via unescaped class option in Admonition directive
    pypi
  25. 6.1
    CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
    pypi
  26. 6.5
    CVE-2026-115354 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
    pypi maintainer advisory
  27. 8.6
    CVE-2026-115353 Mistune before 3.3.0 Path Traversal via include Directive
    pypi maintainer advisory
  28. 7.5
    CVE-2026-115352 Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
    pypi maintainer advisory
  29. 6.1
    CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
    pypi
  30. 4.7
    CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
    pypi maintainer advisory