Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    GHSA-ffhx-3gqx-873h FacebookAppOAuth2 backend allows login CSRF via missing validate_state() call
    pypi unreviewed · maintainers only
  2. 5.4
    GHSA-99rw-f693-vv9r Login CSRF in Last.fm backend (LastFmAuth) — callback token accepted without session binding
    pypi unreviewed · maintainers only
  3. 5.3
    CVE-2026-103241 vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service
    pypi
  4. 6.8
    GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback
    pypi
  5. 6.1
    CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
    pypi
  6. 7.5
    CVE-2026-110859 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
    pypi
  7. 8.1
    CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
    pypi
  8. 7.5
    CVE-2026-110857 GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
    pypi
  9. 7.5
    CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
    pypi
  10. 6.5
    CVE-2026-110855 GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
    pypi
  11. 6.5
    CVE-2026-107287 Pydantic AI: Excessive resource use when local web fetching converts nested HTML
    pypi
  12. 9.9
    CVE-2026-114612 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
    pypi
  13. 6.3
    CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
    pypi
  14. 4.3
    CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
    pypi
  15. 2.2
    CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services
    pypi
  16. 7.5
    CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
    pypi
  17. 7.0
    CVE-2026-109956 NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path
    pypi
  18. 7.5
    GHSA-qx49-fqc8-xw99 OAuth client could send credentials to an authorization server chosen by the MCP server
    pypi unreviewed · maintainers only
  19. 9.8
    CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability
    pypi
  20. 8.6
    CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access
    pypi
  21. 6.5
    CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
    pypi
  22. 6.8
    CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
    pypi
  23. 6.1
    CVE-2026-49264 OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
    pypi
  24. 7.5
    GHSA-qf6c-j2qx-p22r Arbitrary local file read through literalinclude path traversal
    pypi unreviewed · maintainers only
  25. 7.5
    GHSA-qx2q-xxw7-587f Arbitrary local file read through raw directive :file: and :url: options
    pypi unreviewed · maintainers only
  26. 6.3
    CVE-2026-102598 Werkzeug safe_join() allows Windows special device names
    pypi
  27. —
    GHSA-62mm-xwmv-crhg khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
    pypi
  28. 7.5
    CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
    pypi
  29. 7.5
    GHSA-g28h-2cmm-rj9x langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
    pypi
  30. 8.4
    CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding
    pypi