Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 6.8
    CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)
    pypi
  2. 8.8
    CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
    pypi
  3. 6.3
    CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
    pypi
  4. 7.1
    CVE-2026-61596 djust has broken object-level access control (IDOR)
    pypi
  5. 6.5
    CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
    pypi
  6. 9.1
    CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path
    pypi
  7. 8.1
    CVE-2026-61591 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
    pypi
  8. 7.4
    CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
    pypi
  9. 5.1
    CVE-2026-61597 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
    pypi
  10. 6.5
    CVE-2026-69147 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
    pypi
  11. 6.5
    CVE-2026-57173 vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
    pypi
  12. 8.1
    CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
    pypi
  13. 9.8
    CVE-2025-59953 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
    pypi
  14. 7.7
    CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
    pypi
  15. 6.8
    CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
    pypi
  16. 7.1
    CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
    pypi
  17. 7.4
    CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
    pypi
  18. 5.4
    GHSA-qphp-7285-hhq7 RandomGeneratorNode audit/construct mismatch: get_untrusted_types() reports nothing while load() invokes a file-controlled numpy.random attribute
    pypi unreviewed · maintainers only
  19. 8.8
    GHSA-mccx-9xw7-qw2c RCE via `LossNode` in `skops update`: arbitrary constructor trusted without review
    pypi unreviewed · maintainers only
  20. 7.1
    GHSA-qjp4-vm3r-x9pp Out-of-bounds read (SIGSEGV) when loading a crafted .skops tree model at default trust — unvalidated sklearn Tree node fields
    pypi unreviewed · maintainers only
  21. 7.5
    CVE-2026-102999 pypdf: Possible long runtimes with large amount of embedded files
    pypi
  22. 7.5
    CVE-2026-102998 pypdf: Possible long runtimes when generating appearance streams
    pypi
  23. 7.5
    CVE-2026-103000 pypdf: Possible large memory usage when retrieving alphabetical page labels
    pypi
  24. 8.8
    CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
    pypi
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  25. 5.9
    CVE-2026-92091 Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
    pypi maintainer advisory
  26. 5.3
    CVE-2026-97688 urllib3: Chunked Deflate streaming can enter an infinite loop
    pypi
  27. 7.5
    CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
    pypi
  28. 8.1
    CVE-2026-97687 urllib3: HTTPS proxy TLS configuration may be ignored or overridden
    pypi
  29. 7.8
    CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
    pypi
  30. 8.5
    CVE-2026-106439 Hydra: Mutable instantiate policy sets allow target blocklist bypass
    pypi