Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-59922 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
    pypi
  2. 7.5
    CVE-2026-59928 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
    pypi
  3. 7.5
    CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
    pypi
  4. 6.1
    CVE-2026-115350 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
    pypi maintainer advisory
  5. 4.3
    CVE-2026-59930 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
    pypi
  6. 5.3
    CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
    pypi
  7. 7.5
    CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
    pypi maintainer advisory
  8. 7.5
    CVE-2026-49851 Mistune: Potential DoS via quadratic-time parsing in parse_link_text
    pypi
  9. 7.5
    CVE-2026-115348 Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
    pypi maintainer advisory
  10. 7.5
    CVE-2026-115347 Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
    pypi maintainer advisory
  11. —
    GHSA-jxhr-4j38-fpxg XSS via percent-encoded protocol bypass in safe_url() — javascript%3A bypasses javascript: filter
    pypi unreviewed · maintainers only
  12. 6.1
    GHSA-8ppg-4vv7-9p53 Percent-encoded URL scheme bypass allows XSS via javascript: protocol in safe_url()
    pypi unreviewed · maintainers only
  13. 4.3
    CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
    pypi
  14. 6.3
    CVE-2026-12798 BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
    pypi
  15. 6.3
    CVE-2026-12797 BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization
    pypi
  16. 6.3
    CVE-2026-12796 BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration
    pypi
  17. 7.3
    CVE-2026-12795 BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication
    pypi
  18. 7.3
    CVE-2026-12773 BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
    pypi
    EPSS 1.0% chance of exploitation in 30 days, percentile 63%
  19. 6.3
    CVE-2026-12772 BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
    pypi
  20. 5.0
    CVE-2026-12771 BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
    pypi
  21. 5.4
    CVE-2026-12770 BerriAI litellm Admin Key key_management_endpoints.py improper authorization
    pypi
  22. 9.9
    CVE-2026-5366 Git Argument Injection in prefecthq/prefect
    pypi
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%
  23. 5.9
    CVE-2026-55558 aiosmtplib: STARTTLS response injection
    pypi
  24. 2.1
    CVE-2026-59153 Anki's local HTTP server does not sufficiently validate requests
    pypi
  25. 5.0
    CVE-2026-59152 Arbitrary server-side file read in LangSmith SDK TracingMiddleware
    pypi
  26. 6.5
    CVE-2026-58266 Anki: User scripts in iframes have access to the internal Anki API
    pypi
  27. 5.5
    CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
    pypi
  28. 8.2
    CVE-2026-58499 Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
    pypi
  29. 7.2
    CVE-2026-76238 stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep
    pypi
  30. 8.6
    CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
    pypi