Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    GHSA-r668-x5f9-3qp8 Uncontrolled Native Recursion in cbor2.dumps() Allows Process-Terminating SIGSEGV
    pypi unreviewed · maintainers only
  2. 5.3
    CVE-2026-85999 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
    pypi
  3. 5.3
    CVE-2026-86000 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
    pypi
  4. 4.4
    GHSA-ccw6-q225-c975 pillow_heif.encode() validates plane length as stride_in * height but copies real_stride bytes per row
    pypi unreviewed · maintainers only
  5. 7.5
    GHSA-3xjw-9qpc-53mh Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
    pypi
  6. 9.1
    GHSA-22mg-8gw7-636x Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
    pypi
  7. 7.5
    CVE-2026-102993 pypdf: Possible large memory usage when retrieving Roman page labels
    pypi
  8. 7.5
    CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID
    pypi
  9. 3.7
    CVE-2026-107727 Strawberry legacy graphql-ws retains naturally completed subscription slots
    pypi
  10. 8.6
    CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE
    pypi
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  11. 6.1
    CVE-2026-32773 Apache Spark: XSS Vulnerability in Spark Web 3.5.4
    pypimavenbitnami
  12. 7.4
    CVE-2026-84366 Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
    pypi
  13. 8.8
    CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
    pypi
  14. 7.2
    CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
    pypi maintainer advisory
  15. 7.8
    CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check
    pypi
  16. 2.7
    GHSA-wwmx-rghj-gq83 General JSON JWS kid binding bypass during JWKSet verification
    pypi unreviewed · maintainers only
  17. 7.5
    CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
    pypi
  18. 7.8
    CVE-2026-106441 Hydra logging configuration permits unsafe callable resolution
    pypi
  19. 7.8
    CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution
    pypi
  20. —
    GHSA-73p9-6hrp-8qhr AIIR verification and policy gates could report success without enforcing the control (fail-open)
    pypi
  21. 9.1
    CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
    pypi
  22. 9.1
    CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet
    pypi
  23. 8.8
    CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
    pypi
  24. 8.8
    CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider
    pypi
  25. 7.8
    CVE-2026-90553 vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
    pypi
  26. 7.6
    CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
    pypi
  27. 7.1
    CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values
    pypi
  28. 7.5
    CVE-2026-75508 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
    pypi
  29. 7.5
    CVE-2026-75507 GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
    pypi
  30. 5.0
    CVE-2026-79720 Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, pe…
    pypi