Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 6.8
    CVE-2026-128079 envd: Host file disclosure through requirements path traversal and TOCTOU
    pypi
  2. 7.1
    CVE-2026-108372 LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
    pypi
  3. —
    GHSA-p8g9-xjch-9mxg Unknown JWT key IDs each trigger a JWKS fetch in JWTVerifier, amplifying unauthenticated traffic to the identity provider
    pypi unreviewed · maintainers only
  4. 3.3
    CVE-2026-68549 ClickMigrate has Path Traversal in "revision -m" argument
    pypi
  5. —
    GHSA-2qh8-g8rv-3mx5 Unbounded CIMD document cache and client store allow unauthenticated resource exhaustion in OAuthProxy
    pypi unreviewed · maintainers only
  6. —
    GHSA-gpgx-58w2-xwwf Remote code execution in FastMCP client when parsing a server-supplied tool output schema
    pypi unreviewed · maintainers only
  7. —
    GHSA-76mv-6cmh-q7fj MultiAuth source confusion merges security state across independent authentication providers
    pypi unreviewed · maintainers only
  8. —
    GHSA-pwp3-fpg3-p53c Skill providers read a symlinked SKILL.md that points outside its skill folder
    pypi unreviewed · maintainers only
  9. —
    GHSA-99xm-8q53-5c8p OpenAPI path parameters set to `..` reach other backend routes (incomplete fix for CVE-2026-32871)
    pypi unreviewed · maintainers only
  10. —
    GHSA-qvjc-pw7p-hvg5 OpenAPI components forward undeclared header, cookie, and query arguments, letting clients override configured upstream credentials
    pypi unreviewed · maintainers only
  11. 8.1
    GHSA-mhwm-p596-p7q4 ToolInjectionMiddleware Bypasses Per-Tool Authorization
    pypi unreviewed · maintainers only
  12. —
    GHSA-6868-q46w-rmjv host_origin_protection is silently ignored on the SSE transport
    pypi unreviewed · maintainers only
  13. 6.1
    GHSA-m2xc-hx3h-rjf6 Sensitive Cookie header forwarded to third-party OpenAPI backends
    pypi unreviewed · maintainers only
  14. —
    GHSA-57vm-5fr9-3r5x Incomplete fix for CVE-2025-64340: command injection in claude-code/gemini-cli installers via unsanitized --with deps, entrypoint, and env (Windows)
    pypi unreviewed · maintainers only
  15. 6.5
    GHSA-63pr-7fpf-v477 Component manager enable/disable routes skip the server auth provider when required_scopes is unset
    pypi unreviewed · maintainers only
  16. —
    GHSA-c3q8-4mcq-p7vg Hashed FastMCPApp tool calls bypass disable and allowlist visibility rules
    pypi unreviewed · maintainers only
  17. 3.3
    CVE-2026-113789 pypdf: Possible long runtimes/large memory usage when retrieving form fields
    pypi
  18. 3.3
    CVE-2026-113790 pypdf: Possible large memory usage when parsing arrays and dictionaries
    pypi
  19. 3.3
    CVE-2026-113791 pypdf: Possible large memory usage when parsing content streams
    pypi
  20. 5.3
    CVE-2026-62268 borg extract might modify out-of-tree files when extracting maliciously crafted archives
    pypi
  21. 6.5
    CVE-2026-104266 tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
    pypi
  22. 5.3
    CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
    pypi maintainer advisory
  23. 5.6
    CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
    pypi
  24. —
    GHSA-xwgp-43x8-639j Transitive tarball name escapes download directory and overwrites files
    pypi unreviewed · maintainers only
  25. 7.4
    CVE-2026-114616 Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
    pypi
  26. 8.8
    CVE-2026-116672 Authlib RFC 7592 examples omit registration-access-token client binding
    pypi
  27. 7.5
    CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)
    pypi
  28. 5.4
    CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
    pypi
  29. 4.2
    CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim
    pypi
  30. 6.8
    CVE-2026-114618 Authlib: Default JWT bearer grant accepts assertions for the wrong audience
    pypi