Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    CVE-2026-77528 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
    pypi
  2. 5.7
    GHSA-hqf8-7w95-9r33 Sensitive content disclosure via OpenTelemetry spans in bedrock-agentcore-sdk-python
    pypi unreviewed · maintainers only
  3. 7.5
    CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion
    pypinpmcrates.ionuget
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  4. 7.5
    GHSA-f5rx-pv38-28f9 Denial of Service via Exponential-Time Backtracking on Unbalanced Braces
    pypi unreviewed · maintainers only
  5. 9.2
    CVE-2026-15925 Improper TLS Hostname Verification in Snowflake Connector for Python
    pypi
  6. 7.5
    CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
    pypi
  7. 4.7
    CVE-2026-105315 django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
    pypi
  8. 5.9
    CVE-2026-54254 Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites
    pypi
  9. 7.7
    CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint
    pypi
  10. 6.3
    CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
    pypi
  11. 8.8
    CVE-2026-54449 LangBot: Authenticated RCE Via MCP Configuration
    pypi
  12. 8.4
    CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
    pypi
  13. 7.5
    GHSA-q3p5-v4g2-85hm Denial of Service via Omission of Empty Comma-Slot Counting
    pypi unreviewed · maintainers only
  14. 7.5
    GHSA-88pj-cgpg-492r Denial of Service via Uncontrolled Recursion When Gathering Literals
    pypi unreviewed · maintainers only
  15. 7.8
    CVE-2026-58659 PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
    pypi
  16. 9.3
    CVE-2026-61740 LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
    pypi
  17. 9.3
    CVE-2026-61736 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
    pypi
    EPSS 1.4% chance of exploitation in 30 days, percentile 73%
  18. 9.1
    CVE-2026-43637 Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py
    pypi
  19. 8.4
    CVE-2026-61446 PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery
    pypi
  20. 8.1
    CVE-2026-61443 PraisonAI before 1.6.78 Remote Code Execution via SkillTools
    pypi
  21. 6.5
    CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
    pypi
  22. 7.3
    CVE-2026-61438 PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox
    pypi
  23. 8.6
    CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification
    pypi
  24. 8.2
    CVE-2026-61435 PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
    pypi
  25. 7.8
    CVE-2026-61433 PraisonAI before 4.6.78 Code Injection via API deployment generator
    pypi
  26. 8.5
    CVE-2026-61430 PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl
    pypi
  27. 7.3
    CVE-2026-61427 PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream
    pypi
  28. 6.1
    CVE-2026-60087 PraisonAI before 1.6.78 Tool Approval Cache Bypass
    pypi
  29. 7.5
    CVE-2026-60085 PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
    pypi
  30. 9.8
    CVE-2025-65720 GPT Researcher MCP STDIO configuration allows remote command execution
    pypi