Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-114610 fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
    pypi
  2. 5.8
    CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
    pypi
  3. 7.1
    CVE-2026-114510 Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
    pypi
  4. 9.8
    CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder
    Node.jspypibitnamigo
    kev EPSS 82.6% chance of exploitation in 30 days, percentile 99.6%
  5. 6.5
    CVE-2026-123534 Tornado before 6.6 Path Traversal via static_url() Version Hashing
    pypi maintainer advisory
  6. 5.3
    CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
    pypi
  7. 4.2
    CVE-2026-123535 Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age
    pypi maintainer advisory
  8. 2.1
    CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs
    pypi
  9. 5.3
    CVE-2026-116577 Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
    pypi
  10. 8.1
    CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
    pypi
  11. 6.5
    CVE-2026-115886 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
    pypibitnami
  12. 8.8
    CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
    pypi
  13. 8.1
    CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
    pypi maintainer advisory
  14. 7.1
    CVE-2026-115580 pypdf: Possible long runtimes for large xref table header limits
    pypi
  15. 7.1
    CVE-2026-115585 pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
    pypi
  16. 7.1
    CVE-2026-115572 pypdf: Possible long runtimes for repeated references to the same missing object
    pypi
  17. 6.0
    CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
    pypi
  18. 4.8
    CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
    pypi
  19. 7.5
    GHSA-4whf-38hw-pxxh Fetching attacker-controlled HTML with web_fetch_tool can delay other work in the same process
    pypi unreviewed · maintainers only
  20. 7.5
    CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
    pypi
  21. 8.1
    CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
    pypi
  22. 7.5
    CVE-2026-114050 vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID
    pypi
  23. 3.3
    CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
    pypi
  24. —
    GHSA-hq85-5cpj-mr62 uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
    pypi
  25. 5.9
    GHSA-vqqp-x5qm-5qp4 FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
    pypi
  26. 6.8
    GHSA-7xgj-8392-5q4r FastMCP: Post-transform component authorization is skipped on direct calls
    pypi
  27. 6.8
    CVE-2026-115910 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
    pypi
  28. 4.0
    GHSA-xrch-8vh7-h656 Integer Overflow in Shape Inference Data Propagation (MathOpTwoIntegers + Concat)
    pypi unreviewed · maintainers only
  29. 6.2
    CVE-2026-115922 ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
    pypi
  30. 6.2
    CVE-2026-115920 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
    pypi