Skip to content
Fencer Intel

All · pypi

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-115916 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
    pypi
  2. 8.1
    CVE-2026-115915 vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
    pypi
  3. 6.5
    CVE-2026-115914 vLLM DeepSeek-OCR image processing vulnerable to denial of service
    pypi
  4. 6.5
    CVE-2026-115913 vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
    pypi
  5. 7.5
    CVE-2026-115912 vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
    pypi
  6. 6.5
    CVE-2026-115911 vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
    pypi
  7. 7.5
    CVE-2026-126304 NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader
    pypi
  8. 7.5
    CVE-2026-126303 NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()
    pypi
  9. 3.3
    CVE-2026-126302 NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query
    pypi maintainer advisory
  10. 5.3
    CVE-2026-126301 NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize
    pypi
  11. 7.5
    GHSA-hm48-5chc-q85f Three quadratic ReDOS patterns in clean.py
    pypi unreviewed · maintainers only
  12. 5.3
    CVE-2026-126300 NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize
    pypi
  13. 7.8
    CVE-2026-128134 NLTK dot2img runs Graphviz 'dot' without the trusted-exec chokepoint, enabling local code execution via a writable PATH element
    pypi maintainer advisory
  14. 7.5
    CVE-2026-126299 NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring
    pypi
  15. 7.5
    CVE-2026-126298 NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form
    pypi
  16. 7.5
    CVE-2026-126297 NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances
    pypi
  17. 4.8
    CVE-2026-126296 NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params
    pypi maintainer advisory
  18. 6.8
    CVE-2026-126295 NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths
    pypi
  19. 7.5
    CVE-2026-119286 GraphQL-core: Denial of service via memory leak in aborted validations
    pypi
  20. 8.4
    CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
    pypi
  21. 8.5
    CVE-2026-49272 OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
    pypi
  22. 5.4
    CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
    pypi
  23. 8.7
    CVE-2026-115775 Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
    pypi
  24. 7.5
    CVE-2026-115778 Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
    pypi
  25. 7.5
    CVE-2026-115776 Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
    pypi
  26. 4.9
    CVE-2026-115774 Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
    pypi
  27. 7.5
    GHSA-vpp8-g58w-m8mp Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
    pypi
  28. 3.1
    CVE-2026-83813 Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
    pypi
  29. 7.1
    CVE-2026-115586 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
    pypibitnami
  30. 8.1
    CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
    pypinpm