# cve.now: PyPI packages

The newest entries affecting PyPI packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [CVE-2026-119284](https://cve.now/CVE-2026-119284.md): joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection (CVSS 6.9, authlib joserfc · joserfc)
- [CVE-2026-119283](https://cve.now/CVE-2026-119283.md): joserfc: Unbounded JWE General JSON \`recipients\` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption (CVSS 7.5, authlib joserfc · joserfc)
- [GHSA-VPP8-G58W-M8MP](https://cve.now/GHSA-VPP8-G58W-M8MP.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset (high (no CVSS), twisted)
- [CVE-2026-118668](https://cve.now/CVE-2026-118668.md): LangGraph JavaScript custom authentication may permit cross-user Store access (CVSS 8.6, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-118667](https://cve.now/CVE-2026-118667.md): LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (CVSS 4.3, langchain-ai langgraph · langchain-ai langgraph-sdk +2)
- [CVE-2026-116694](https://cve.now/CVE-2026-116694.md): OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation (CVSS 6.3, open-telemetry opentelemetry-python · opentelemetry-propaga…)
- [CVE-2026-116692](https://cve.now/CVE-2026-116692.md): MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules (CVSS 9.8, mlflow)
- [CVE-2026-116691](https://cve.now/CVE-2026-116691.md): MLflow CrewAI autologging records LLM provider API keys in logged trace spans (CVSS 6.5, mlflow)
- [CVE-2026-116690](https://cve.now/CVE-2026-116690.md): MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source (CVSS 7.5, mlflow)
- [CVE-2026-116686](https://cve.now/CVE-2026-116686.md): Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (CVSS 6.5, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-116685](https://cve.now/CVE-2026-116685.md): Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVSS 5.9, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-116684](https://cve.now/CVE-2026-116684.md): Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (CVSS 6.8, modelcontextprotocol python-sdk · mcp)
- [GHSA-WF6J-7HVR-GR93](https://cve.now/GHSA-WF6J-7HVR-GR93.md): Hydra legacy target blacklist permits unsafe PyYAML loading (high (no CVSS), hydra-core)
- [GHSA-3W55-933P-8PV5](https://cve.now/GHSA-3W55-933P-8PV5.md): Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage (high (no CVSS), strands-agents)
- [GHSA-763V-5PJM-FX36](https://cve.now/GHSA-763V-5PJM-FX36.md): Strands Agents: Default FileSessionManager storage is world-readable on shared systems (medium (no CVSS), strands-agents)
- [GHSA-G5FF-637F-6Q2M](https://cve.now/GHSA-G5FF-637F-6Q2M.md): LiteLLM: internal\_user\_viewer arbitrary local file read via \`vertex\_ai\_credentials\` (high (no CVSS), litellm)
- [GHSA-HHWW-MRG2-969H](https://cve.now/GHSA-HHWW-MRG2-969H.md): LiteLLM vulnerable to reflected XSS in /sso/debug/callback (medium (no CVSS), litellm)
- [CVE-2026-117601](https://cve.now/CVE-2026-117601.md): Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions (CVSS 9.3, spesmilo electrum · electrum)
- [CVE-2026-116589](https://cve.now/CVE-2026-116589.md): Datadog dd-trace-py: IAST instrumentation can lead to application DOS (CVSS 8.2, DataDog dd-trace-py · ddtrace)
- [CVE-2026-116588](https://cve.now/CVE-2026-116588.md): Datadog dd-trace-py: ReDOS in URL query string obfuscation (CVSS 8.7, DataDog dd-trace-py · ddtrace)
- [CVE-2026-116579](https://cve.now/CVE-2026-116579.md): Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) (CVSS 5.9, crossbario autobahn-python · autobahn)
- [CVE-2026-116578](https://cve.now/CVE-2026-116578.md): Tornado: Open redirect in RedirectHandler via protocol-relative URLs (CVSS 2.1, tornadoweb tornado · tornado)
- [CVE-2026-116577](https://cve.now/CVE-2026-116577.md): Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (CVSS 5.3, tornadoweb tornado · tornado)
- [CVE-2026-116575](https://cve.now/CVE-2026-116575.md): Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build\_session\_scope) (CVSS 6.3, mem0ai mem0 · mem0ai)
- [CVE-2026-115927](https://cve.now/CVE-2026-115927.md): Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (CVSS 5.3, tornadoweb tornado · tornado)
- [CVE-2026-115924](https://cve.now/CVE-2026-115924.md): Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs (CVSS 8.6, danielgatis rembg · rembg)
- [CVE-2026-115922](https://cve.now/CVE-2026-115922.md): ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs (CVSS 6.2, onnx)
- [CVE-2026-115921](https://cve.now/CVE-2026-115921.md): ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute (CVSS 6.2, onnx)
- [CVE-2026-115920](https://cve.now/CVE-2026-115920.md): ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank (CVSS 6.2, onnx)
- [CVE-2026-115919](https://cve.now/CVE-2026-115919.md): ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) (CVSS 6.2, onnx)
- [CVE-2026-115918](https://cve.now/CVE-2026-115918.md): vLLM: Responses API bypasses trust\_request\_chat\_template for chat\_template\_kwargs (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115917](https://cve.now/CVE-2026-115917.md): vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server (CVSS 3.4, vllm-project vllm · vllm)
- [CVE-2026-115916](https://cve.now/CVE-2026-115916.md): vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115915](https://cve.now/CVE-2026-115915.md): vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (CVSS 8.1, vllm-project vllm · vllm)
- [CVE-2026-115914](https://cve.now/CVE-2026-115914.md): vLLM DeepSeek-OCR image processing vulnerable to denial of service (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115913](https://cve.now/CVE-2026-115913.md): vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115912](https://cve.now/CVE-2026-115912.md): vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2026-115911](https://cve.now/CVE-2026-115911.md): vLLM: DoS via unbounded chat\_template Jinja2 rendering exhausts the renderer thread pool (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115910](https://cve.now/CVE-2026-115910.md): Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim (CVSS 6.8, python-social-auth social-core · social-auth-core)
- [CVE-2026-116178](https://cve.now/CVE-2026-116178.md): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-116177](https://cve.now/CVE-2026-116177.md): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-116176](https://cve.now/CVE-2026-116176.md): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-116173](https://cve.now/CVE-2026-116173.md): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output\_candidates.token\_ids (CVSS 8.2, vllm-project vllm · vllm)
- [GHSA-XMJ3-9GF7-H52W](https://cve.now/GHSA-XMJ3-9GF7-H52W.md): setuptools: Windows path escape via namespace\_packages.txt during legacy wheel installation Description (low (no CVSS), setuptools)
- [GHSA-7XGJ-8392-5Q4R](https://cve.now/GHSA-7XGJ-8392-5Q4R.md): FastMCP: Post-transform component authorization is skipped on direct calls (medium (no CVSS), fastmcp · fastmcp-slim)
- [GHSA-VQQP-X5QM-5QP4](https://cve.now/GHSA-VQQP-X5QM-5QP4.md): FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authori (medium (no CVSS), fastmcp · fastmcp-slim)
- [CVE-2026-115886](https://cve.now/CVE-2026-115886.md): MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints (CVSS 6.5, mlflow)
- [CVE-2026-115885](https://cve.now/CVE-2026-115885.md): LangGraph CLI prints the registry push token in \`langgraph deploy --verbose\` output (CVSS 4.1, langchain-ai langgraph · langgraph-cli)
- [CVE-2026-115883](https://cve.now/CVE-2026-115883.md): LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores (CVSS 6.0, langchain-ai langgraph · langchain-ai langgraph-checkpoi… +3)
- [CVE-2026-115877](https://cve.now/CVE-2026-115877.md): Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (CVSS 5.4, twisted)
- [CVE-2026-83813](https://cve.now/CVE-2026-83813.md): Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation (CVSS 3.1, twisted)
- [CVE-2026-115778](https://cve.now/CVE-2026-115778.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (CVSS 7.5, twisted)
- [CVE-2026-115776](https://cve.now/CVE-2026-115776.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (CVSS 7.5, twisted)
- [CVE-2026-115775](https://cve.now/CVE-2026-115775.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (CVSS 8.7, twisted)
- [CVE-2026-115774](https://cve.now/CVE-2026-115774.md): Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (CVSS 4.9, twisted)
- [CVE-2026-115586](https://cve.now/CVE-2026-115586.md): virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) (CVSS 7.1, pypa virtualenv · virtualenv)
- [CVE-2026-115585](https://cve.now/CVE-2026-115585.md): pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-115580](https://cve.now/CVE-2026-115580.md): pypdf: Possible long runtimes for large xref table header limits (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-115572](https://cve.now/CVE-2026-115572.md): pypdf: Possible long runtimes for repeated references to the same missing object (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-54711](https://cve.now/CVE-2026-54711.md): PGHoard: Password written to debug log (CVSS 2.4, Aiven-Open pghoard · pghoard)
- [CVE-2026-57117](https://cve.now/CVE-2026-57117.md): PraisonAI: Compute-bridged file tools allow shell command injection (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57121](https://cve.now/CVE-2026-57121.md): PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API (CVSS 8.1, MervinPraison PraisonAI · praisonai-platform)
- [CVE-2026-57116](https://cve.now/CVE-2026-57116.md): PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57114](https://cve.now/CVE-2026-57114.md): PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding (CVSS 7.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57113](https://cve.now/CVE-2026-57113.md): PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion (CVSS 8.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56840](https://cve.now/CVE-2026-56840.md): PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56838](https://cve.now/CVE-2026-56838.md): PraisonAI recipe.run\_stream skips dangerous-tool policy enforcement (CVSS 7.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56837](https://cve.now/CVE-2026-56837.md): PraisonAI LinearBot processes unsigned webhooks when LINEAR\_WEBHOOK\_SECRET is missing (CVSS 8.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56836](https://cve.now/CVE-2026-56836.md): PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard (CVSS 8.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56835](https://cve.now/CVE-2026-56835.md): PraisonAI Slack app\_mention bypasses configured user/channel authorization (CVSS 8.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56834](https://cve.now/CVE-2026-56834.md): PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56833](https://cve.now/CVE-2026-56833.md): PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56832](https://cve.now/CVE-2026-56832.md): PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-114620](https://cve.now/CVE-2026-114620.md): Authlib: Unvalidated request\_uri fetch in JWT-secured authorization request (JAR) leading to SSRF (CVSS 5.4, authlib)
- [CVE-2026-114619](https://cve.now/CVE-2026-114619.md): Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens (CVSS 4.6, authlib)
- [CVE-2026-114618](https://cve.now/CVE-2026-114618.md): Authlib: Default JWT bearer grant accepts assertions for the wrong audience (CVSS 6.8, authlib)
- [CVE-2026-114617](https://cve.now/CVE-2026-114617.md): Authlib: ID token can disable its own nonce validation via the nonce\_supported claim (CVSS 4.2, authlib)
- [CVE-2026-114616](https://cve.now/CVE-2026-114616.md): Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) (CVSS 7.4, authlib)
- [CVE-2026-114615](https://cve.now/CVE-2026-114615.md): Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys (CVSS 7.4, authlib)
- [CVE-2026-114614](https://cve.now/CVE-2026-114614.md): Authlib: is\_secure\_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts (CVSS 2.6, authlib)
- [CVE-2026-115419](https://cve.now/CVE-2026-115419.md): Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server (CVSS 8.1, AWS strands-agents · AWS strands-agents/sdk +2)
- [CVE-2026-115355](https://cve.now/CVE-2026-115355.md): Mistune before 3.3.0 Path Traversal and XSS via Include Directive (CVSS 8.7, lepture mistune · mistune)
- [CVE-2026-114613](https://cve.now/CVE-2026-114613.md): MessagePack: Unbounded memory leak in msgpack C extension on strict\_map\_key validation failure (CVSS 7.5, msgpack-python · msgpack)
- [CVE-2026-114612](https://cve.now/CVE-2026-114612.md): LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key (CVSS 9.9, BerriAI litellm · litellm)
- [CVE-2026-114610](https://cve.now/CVE-2026-114610.md): fpdf2: Exponential SVG '\<use\>' expansion causes CPU and memory exhaustion in 'FPDF.image()' (CVSS 6.5, py-pdf fpdf2 · fpdf2)
- [CVE-2026-114609](https://cve.now/CVE-2026-114609.md): fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content (CVSS 5.8, py-pdf fpdf2 · fpdf2)
- [CVE-2026-114608](https://cve.now/CVE-2026-114608.md): Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT\_HOME (CVSS 5.4, pylint-dev pylint · pylint)
- [CVE-2026-114605](https://cve.now/CVE-2026-114605.md): dnspython dns.name.from\_wire\_parser() excessive CPU use (CVSS 7.5, rthalley dnspython · dnspython)
- [CVE-2026-75507](https://cve.now/CVE-2026-75507.md): GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule (CVSS 7.5, graphql-python graphql-core · graphql-core)
- [CVE-2026-75508](https://cve.now/CVE-2026-75508.md): GraphQL-core: Denial of service via comment tokens bypassing the parser's max\_tokens limit (CVSS 7.5, graphql-python graphql-core · graphql-core)
- [CVE-2026-114603](https://cve.now/CVE-2026-114603.md): OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (CVSS 5.3, open-telemetry opentelemetry-python · opentelemetry-api)
- [CVE-2026-114510](https://cve.now/CVE-2026-114510.md): Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (\_escape()) - full graph wipe from ingested-document content (CVSS 7.1, stevereiner flexible-graphrag · flexible-graphrag)
- [CVE-2026-111497](https://cve.now/CVE-2026-111497.md): Out-of-Bounds Write in Google Brotli Decoder (CVSS 9.2, KEV, Google Brotli · node +6)
- [CVE-2026-115324](https://cve.now/CVE-2026-115324.md): mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store (CVSS 9.2, mem0ai mem0 · mem0ai)
- [CVE-2026-114501](https://cve.now/CVE-2026-114501.md): Pillow: Arrow export leaks stale heap memory when PILLOW\_ALIGNMENT \> 1 (CVSS 6.3, python-pillow Pillow · pillow)
- [CVE-2026-96639](https://cve.now/CVE-2026-96639.md): Pillow multi-frame loaders can reuse stale native image storage after mode transitions (CVSS 9.8, python-pillow Pillow · pillow)
- [CVE-2026-96636](https://cve.now/CVE-2026-96636.md): Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) (CVSS 6.5, python-pillow Pillow · pillow)
- [CVE-2026-96640](https://cve.now/CVE-2026-96640.md): Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion (CVSS 8.2, python-pillow Pillow · pillow)
- [CVE-2026-96637](https://cve.now/CVE-2026-96637.md): Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (CVSS 7.1, python-pillow Pillow · pillow)
- [CVE-2026-96778](https://cve.now/CVE-2026-96778.md): Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer (CVSS 7.7, python-pillow Pillow · pillow)
- [CVE-2026-96643](https://cve.now/CVE-2026-96643.md): Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time (CVSS 7.1, python-pillow Pillow · pillow)
- [CVE-2026-96644](https://cve.now/CVE-2026-96644.md): Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) (CVSS 7.1, python-pillow Pillow · pillow)
- [CVE-2026-96641](https://cve.now/CVE-2026-96641.md): Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise (CVSS 6.5, python-pillow Pillow · pillow)
- [CVE-2026-96642](https://cve.now/CVE-2026-96642.md): Pillow: TarIO negative size field causes infinite CPU-spin loop (CVSS 7.1, python-pillow Pillow · pillow)
- [CVE-2026-96638](https://cve.now/CVE-2026-96638.md): Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode (CVSS 6.5, python-pillow Pillow · pillow)
- [CVE-2026-114145](https://cve.now/CVE-2026-114145.md): GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVSS 7.5, gitpython-developers GitPython · gitpython)
- [CVE-2026-114140](https://cve.now/CVE-2026-114140.md): nbconvert: File write via path traversal in cell output filenames (CVSS 8.8, jupyter nbconvert · nbconvert)
- [CVE-2026-114138](https://cve.now/CVE-2026-114138.md): Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation (CVSS 7.5, encode django-rest-framework · djangorestframework)
- [CVE-2026-114137](https://cve.now/CVE-2026-114137.md): Django REST framework: TokenProxy.delete() reports success and revokes nothing (CVSS 7.4, encode django-rest-framework · djangorestframework)
- [CVE-2026-114136](https://cve.now/CVE-2026-114136.md): Django REST framework: JSONParser applies an attacker-named codec to the request stream (CVSS 7.5, encode django-rest-framework · djangorestframework)
- [CVE-2026-114135](https://cve.now/CVE-2026-114135.md): Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization (CVSS 8.8, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-113795](https://cve.now/CVE-2026-113795.md): pypdf: Possible large memory usage for streams with multiple filters (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113794](https://cve.now/CVE-2026-113794.md): pypdf: Possible infinite loop when hitting EOF in standard xref table (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113793](https://cve.now/CVE-2026-113793.md): pypdf: Possible infinite loop when removing tree items (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113792](https://cve.now/CVE-2026-113792.md): pypdf: Possible infinite loop in PdfWriter.find\_outline\_item (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113791](https://cve.now/CVE-2026-113791.md): pypdf: Possible large memory usage when parsing content streams (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113790](https://cve.now/CVE-2026-113790.md): pypdf: Possible large memory usage when parsing arrays and dictionaries (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113789](https://cve.now/CVE-2026-113789.md): pypdf: Possible long runtimes/large memory usage when retrieving form fields (CVSS 6.0, py-pdf pypdf · pypdf)
- [CVE-2026-113786](https://cve.now/CVE-2026-113786.md): pypdf: Unvalidated JPEG image data loading (CVSS 2.3, py-pdf pypdf · pypdf)
- [CVE-2026-114386](https://cve.now/CVE-2026-114386.md): Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run\_code (CVSS 6.3, pydantic-ai-harness)
- [CVE-2026-114110](https://cve.now/CVE-2026-114110.md): Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries (CVSS 8.7, astral-sh uv · uv)
- [CVE-2026-114109](https://cve.now/CVE-2026-114109.md): uv before 0.11.15 Arbitrary File Write via Entry Point Names (CVSS 8.7, astral-sh uv · uv)
- [CVE-2026-114108](https://cve.now/CVE-2026-114108.md): HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE (CVSS 9.3, HKUDS Vibe-Trading · vibe-trading-ai)
- [CVE-2026-114107](https://cve.now/CVE-2026-114107.md): HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool (CVSS 8.7, HKUDS Vibe-Trading · vibe-trading-ai)
- [CVE-2026-114106](https://cve.now/CVE-2026-114106.md): HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read\_document and safe\_user\_path (CVSS 8.7, HKUDS Vibe-Trading · vibe-trading-ai)
- [CVE-2026-114098](https://cve.now/CVE-2026-114098.md): Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks (CVSS 7.3, jelmer dulwich · dulwich)
- [CVE-2026-114097](https://cve.now/CVE-2026-114097.md): Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter\_branch Index Filter (CVSS 7.3, jelmer dulwich · dulwich)
- [CVE-2026-114096](https://cve.now/CVE-2026-114096.md): Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths (CVSS 7.3, jelmer dulwich · dulwich)
- [CVE-2026-114095](https://cve.now/CVE-2026-114095.md): Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve\_object (CVSS 7.1, jelmer dulwich · dulwich)
- [CVE-2026-114094](https://cve.now/CVE-2026-114094.md): Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths (CVSS 8.7, jelmer dulwich · dulwich)
- [CVE-2026-114055](https://cve.now/CVE-2026-114055.md): vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm\_processor\_kwargs (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-114053](https://cve.now/CVE-2026-114053.md): vLLM 0.7.3 before 0.31.0 RCE via mm\_processor\_kwargs.code\_revision (CVSS 9.2, vllm-project vllm · vllm)
- [CVE-2026-114050](https://cve.now/CVE-2026-114050.md): vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2021-48020](https://cve.now/CVE-2021-48020.md): Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays (CVSS 8.3, vyperlang vyper · vyper)
- [CVE-2021-48019](https://cve.now/CVE-2021-48019.md): Vyper before 0.2.9 Incorrect RETURNDATASIZE in create\_forwarder\_to Proxies (CVSS 6.3, vyperlang vyper · vyper)
- [CVE-2021-48018](https://cve.now/CVE-2021-48018.md): Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator (CVSS 8.3, vyperlang vyper · vyper)
- [CVE-2020-37289](https://cve.now/CVE-2020-37289.md): Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values (CVSS 6.3, vyperlang vyper · vyper)
- [CVE-2020-37288](https://cve.now/CVE-2020-37288.md): Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops (CVSS 6.3, vyperlang vyper · vyper)
- [CVE-2020-37287](https://cve.now/CVE-2020-37287.md): Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments (CVSS 8.2, vyperlang vyper · vyper)
- [CVE-2020-37286](https://cve.now/CVE-2020-37286.md): Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls (CVSS 8.3, vyperlang vyper · vyper)
- [CVE-2026-113726](https://cve.now/CVE-2026-113726.md): virtualenv activate runs commands from the environment name in zsh with PROMPT\_SUBST (CVSS 7.8, pypa virtualenv · virtualenv)
- [CVE-2026-113776](https://cve.now/CVE-2026-113776.md): virtualenv activation scripts run code from a path that contains a placeholder name (CVSS 7.8, pypa virtualenv · virtualenv)
- [CVE-2026-113732](https://cve.now/CVE-2026-113732.md): virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote (CVSS 7.8, pypa virtualenv · virtualenv)
- [PYSEC-2026-4320](https://cve.now/PYSEC-2026-4320.md): certifi bundles emSign root CAs with compromised intermediate CA keys (no CVSS, certifi)
- [CVE-2026-113731](https://cve.now/CVE-2026-113731.md): djust: Arbitrary absolute-path file read in the find\_handlers\_for\_template MCP tool (CVSS 3.3, djust-org djust · djust)
- [CVE-2026-113725](https://cve.now/CVE-2026-113725.md): virtualenv bash activate runs commands from an environment name with a backslash before $ (CVSS 7.8, pypa virtualenv · virtualenv)
- [CVE-2026-113724](https://cve.now/CVE-2026-113724.md): virtualenv: Deletion recovery can change a symlink target's mode (CVSS 4.5, pypa virtualenv · virtualenv)
- [CVE-2026-113723](https://cve.now/CVE-2026-113723.md): virtualenv: Bash prompt values can change meaning under older compatibility modes (CVSS 7.1, pypa virtualenv · virtualenv)
- [CVE-2026-113722](https://cve.now/CVE-2026-113722.md): virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax (CVSS 7.8, pypa virtualenv · virtualenv)
- [CVE-2026-113721](https://cve.now/CVE-2026-113721.md): virtualenv: Generated files can follow existing destination links (CVSS 4.5, pypa virtualenv · virtualenv)
- [CVE-2026-113720](https://cve.now/CVE-2026-113720.md): virtualenv: Seeded files retain permissions from an older cache (CVSS 4.4, pypa virtualenv · virtualenv)
- [CVE-2026-113715](https://cve.now/CVE-2026-113715.md): virtualenv: Venv configuration readback can reinterpret path boundaries (CVSS 2.0, pypa virtualenv · virtualenv)
- [CVE-2026-113719](https://cve.now/CVE-2026-113719.md): virtualenv: Seed replacement does not contain metadata deletion paths (CVSS 4.5, pypa virtualenv · virtualenv)
- [CVE-2026-113718](https://cve.now/CVE-2026-113718.md): virtualenv: Xonsh activation literals depend on the script decoding codec (CVSS 7.1, pypa virtualenv · virtualenv)
- [CVE-2026-113717](https://cve.now/CVE-2026-113717.md): virtualenv: Pip seeding with download omits wheel digest verification (CVSS 2.3, pypa virtualenv · virtualenv)
- [CVE-2026-113716](https://cve.now/CVE-2026-113716.md): virtualenv: Builtin creation follows linked environment directories (CVSS 4.5, pypa virtualenv · virtualenv)
- [CVE-2026-113714](https://cve.now/CVE-2026-113714.md): virtualenv: Downloaded wheel selection and caching precede verification (CVSS 2.3, pypa virtualenv · virtualenv)
- [CVE-2026-113713](https://cve.now/CVE-2026-113713.md): virtualenv: Temporary app-data can leave dangling seed package links (CVSS 4.4, pypa virtualenv · virtualenv)
- [CVE-2026-112941](https://cve.now/CVE-2026-112941.md): filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock (CVSS 3.3, tox-dev filelock · filelock)
- [CVE-2026-112940](https://cve.now/CVE-2026-112940.md): filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1, tox-dev filelock · filelock)
- [CVE-2026-112939](https://cve.now/CVE-2026-112939.md): filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker (CVSS 4.7, tox-dev filelock · filelock)
- [CVE-2026-112937](https://cve.now/CVE-2026-112937.md): filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-\* link directory name (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112936](https://cve.now/CVE-2026-112936.md): filelock: ReadWriteLock follows a symlink at the lock path into SQLite (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112935](https://cve.now/CVE-2026-112935.md): filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders (CVSS 4.7, tox-dev filelock · filelock)
- [CVE-2026-112934](https://cve.now/CVE-2026-112934.md): filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112915](https://cve.now/CVE-2026-112915.md): filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout (CVSS 5.5, tox-dev filelock · filelock)
- [CVE-2026-112914](https://cve.now/CVE-2026-112914.md): filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-112912](https://cve.now/CVE-2026-112912.md): filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker (CVSS 2.5, tox-dev filelock · filelock)
- [CVE-2026-112911](https://cve.now/CVE-2026-112911.md): filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion (CVSS 6.3, tox-dev filelock · filelock)
- [CVE-2026-112909](https://cve.now/CVE-2026-112909.md): filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112906](https://cve.now/CVE-2026-112906.md): filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse (CVSS 4.7, tox-dev filelock · filelock)
- [CVE-2026-112901](https://cve.now/CVE-2026-112901.md): Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112900](https://cve.now/CVE-2026-112900.md): Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-112898](https://cve.now/CVE-2026-112898.md): Pillow: Image.quantize() with empty palette leaks uninitialized stack memory (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112897](https://cve.now/CVE-2026-112897.md): Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112896](https://cve.now/CVE-2026-112896.md): Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (CVSS 8.8, python-pillow Pillow · pillow)
- [CVE-2026-112895](https://cve.now/CVE-2026-112895.md): Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112398](https://cve.now/CVE-2026-112398.md): Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-53995](https://cve.now/CVE-2026-53995.md): MLflow 3.17.1 and prior Path Traversal via Trace ID API (CVSS 8.8, mlflow)
- [CVE-2026-112396](https://cve.now/CVE-2026-112396.md): Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer (CVSS 5.9, python-pillow Pillow · pillow)
- [CVE-2026-108372](https://cve.now/CVE-2026-108372.md): LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files (CVSS 7.1, huangruiteng loopx · loopx)
- [CVE-2026-96620](https://cve.now/CVE-2026-96620.md): Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution (CVSS 9.2, anthropics claude-agent-sdk-python · claude-agent-sdk)
- [CVE-2026-110860](https://cve.now/CVE-2026-110860.md): GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() (CVSS 6.9, gitpython-developers GitPython · gitpython)
- [CVE-2026-110859](https://cve.now/CVE-2026-110859.md): GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110858](https://cve.now/CVE-2026-110858.md): GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVSS 9.2, gitpython-developers GitPython · gitpython)
- [CVE-2026-110857](https://cve.now/CVE-2026-110857.md): GitPython before 3.2.0 Command Execution via ls\_remote ext:: URLs (CVSS 7.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110856](https://cve.now/CVE-2026-110856.md): GitPython before 3.2.0 ReDoS via \_re\_actor\_epoch in parse\_actor\_and\_date (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110855](https://cve.now/CVE-2026-110855.md): GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name (CVSS 7.1, gitpython-developers GitPython · gitpython)
- [CVE-2026-109956](https://cve.now/CVE-2026-109956.md): NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path (CVSS 8.3, nltk)
- [GHSA-P3PR-8F3M-4QP8](https://cve.now/GHSA-P3PR-8F3M-4QP8.md): pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host (medium (no CVSS), pyload-ng)
- [CVE-2026-106435](https://cve.now/CVE-2026-106435.md): Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver (CVSS 5.9, MongoDB Python Driver · pymongo)
- [CVE-2026-105759](https://cve.now/CVE-2026-105759.md): vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service) (CVSS 5.9, vllm-project vllm · vllm)
- [CVE-2026-96760](https://cve.now/CVE-2026-96760.md): Authlib library contains a signature‑verification bypass vulnerability (CVSS 9.8, Authlib)
- [CVE-2026-100653](https://cve.now/CVE-2026-100653.md): vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation (CVSS 8.3, vllm-project vllm · vllm)
- [GHSA-JM5P-837G-RV8G](https://cve.now/GHSA-JM5P-837G-RV8G.md): Wagtail: Improper restriction handling on Page translation API endpoint (medium (no CVSS), wagtail)
- [CVE-2026-7873](https://cve.now/CVE-2026-7873.md): Code Injection Vulnerability in Code Validation Endpoint (CVSS 9.9, IBM Langflow OSS · langflow)
- [CVE-2026-27975](https://cve.now/CVE-2026-27975.md): Ajenti has a potential Remote Code Execution (CVSS 8.1, ajenti · aj)
- [GHSA-W466-2WFC-8G58](https://cve.now/GHSA-W466-2WFC-8G58.md): Open WebUI has vulnerable dependency on starlette via fastapi (high (no CVSS), open-webui)
- [CVE-2023-27524](https://cve.now/CVE-2023-27524.md): Apache Superset: Session validation vulnerability when using provided default SECRET\_KEY (CVSS 8.9, KEV, Apache Software Foundation Apache Superset · superset +1)
- [GHSA-JGPV-4H4C-XHW3](https://cve.now/GHSA-JGPV-4H4C-XHW3.md): Uncontrolled Resource Consumption in pillow (medium (no CVSS), pillow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/pypi
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.