Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 4.6
    CVE-2026-114619 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
    pypi
  2. 7.4
    CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
    pypi
  3. 6.1
    CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation
    pypi
  4. 7.5
    CVE-2026-116690 MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
    pypi
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%
  5. 6.5
    CVE-2026-116691 MLflow CrewAI autologging records LLM provider API keys in logged trace spans
    pypi
  6. 7.4
    GHSA-pmqj-r2x2-vx88 Concurrent handshakes with a shared `SSLContext` may disable certificate verification of subsequent handshakes on Windows and macOS
    pypi unreviewed · maintainers only
  7. 6.8
    GHSA-8v28-6h89-pmvr SSLContext.wrap_socket() missing validation of server_hostname parameter for macOS and Windows
    pypi unreviewed · maintainers only
  8. 5.3
    CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)
    pypi
  9. 3.3
    CVE-2026-113792 pypdf: Possible infinite loop in PdfWriter.find_outline_item
    pypi
  10. 4.3
    CVE-2026-113793 pypdf: Possible infinite loop when removing tree items
    pypi
  11. 5.5
    CVE-2026-113794 pypdf: Possible infinite loop when hitting EOF in standard xref table
    pypi
  12. 5.3
    GHSA-v999-q5cj-95jg COPY stream declared size causes zero-progress extraction loop
    pypi unreviewed · maintainers only
  13. —
    GHSA-6pr6-cqpq-x889 Memory-exhaustion DoS via unbounded numfiles allocation in 7z header parser
    pypi unreviewed · maintainers only
  14. 8.8
    GHSA-jwx8-hv8g-gjjq Arbitrary file write above the extraction directory via symlink-chain traversal
    pypi unreviewed · maintainers only
  15. 5.3
    CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
    pypi
  16. 7.8
    CVE-2026-113725 virtualenv bash activate runs commands from an environment name with a backslash before $
    pypibitnami
  17. 8.8
    CVE-2026-102643 AsyncSSH: SFTPServer Chroot Escape
    pypi maintainer advisory
  18. 2.6
    CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
    pypi
  19. —
    GHSA-m4mf-rqrp-5pq8 HubSpot, Monzo and WLCG backends collapse all users onto uid "None", allowing any user of the same provider to authenticate as the first user's account
    pypi unreviewed · maintainers only
  20. 8.7
    CVE-2026-114134 Black: GitHub Action installs unvalidated required-version from pyproject.toml
    pypi
  21. 6.9
    CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
    pypi
  22. 5.7
    CVE-2026-107841 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
    pypi
  23. 8.1
    GHSA-68w4-83fh-f2w8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
    pypi
  24. —
    GHSA-9q47-3cm2-2rp8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
    pypi
  25. 7.5
    CVE-2026-123813 pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
    pypi
  26. 7.5
    GHSA-889w-m37p-88m5 pyLoad: Api.set_user_permission never invalidates the target's session
    pypi
  27. 6.4
    CVE-2026-123814 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
    pypi
  28. 9.4
    CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
    pypi
  29. 8.1
    CVE-2026-123816 pyLoad: Authentication bypass in API key validation (check_apikey cache)
    pypi
  30. 5.3
    CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
    pypi