# cve.now: PyPI packages

The newest entries affecting PyPI packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [CVE-2026-128067](https://cve.now/CVE-2026-128067.md): Pillow heap buffer overflow in TIFF save via libtiff (CVSS 8.4, python-pillow Pillow · pillow)
- [CVE-2026-128066](https://cve.now/CVE-2026-128066.md): Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-126360](https://cve.now/CVE-2026-126360.md): OpenTelemetry Python denial of service in traceparent parsing (CVSS 5.3, open-telemetry opentelemetry-python · opentelemetry-api)
- [CVE-2026-126193](https://cve.now/CVE-2026-126193.md): Soup Sieve denial of service in CSS selector parser via deep nesting (CVSS 5.3, facelessuser soupsieve · soupsieve)
- [CVE-2026-126192](https://cve.now/CVE-2026-126192.md): Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time (CVSS 6.3, facelessuser soupsieve · soupsieve)
- [CVE-2026-126191](https://cve.now/CVE-2026-126191.md): Soup Sieve denial of service in CSS selector compilation (CVSS 7.5, facelessuser soupsieve · soupsieve)
- [CVE-2026-126190](https://cve.now/CVE-2026-126190.md): Soup Sieve: Polynomial-time denial of service in the descendant combinator (CVSS 7.5, facelessuser soupsieve · soupsieve)
- [CVE-2026-68549](https://cve.now/CVE-2026-68549.md): ClickMigrate has Path Traversal in "revision -m" argument (CVSS 3.3, QueueForge ClickMigrate · clickmigrate)
- [CVE-2026-108167](https://cve.now/CVE-2026-108167.md): The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when… (no CVSS, auth0-ai-langchain · auth0-ai-llamaindex)
- [CVE-2026-121691](https://cve.now/CVE-2026-121691.md): Unbounded decompression in the whatstk ZIP loader exhausts memory and disk (CVSS 6.7, lucasrodes whatstk)
- [CVE-2026-125123](https://cve.now/CVE-2026-125123.md): compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages (CVSS 2.3, tmatens compose-lint · compose-lint)
- [CVE-2026-125122](https://cve.now/CVE-2026-125122.md): compose-lint workflow command injection in JSON and SARIF output (CVSS 2.3, tmatens compose-lint · compose-lint)
- [CVE-2026-125121](https://cve.now/CVE-2026-125121.md): compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output (CVSS 5.3, tmatens compose-lint · compose-lint)
- [CVE-2026-125744](https://cve.now/CVE-2026-125744.md): Missing permission check in ticket layout API (CVSS 1.2, pretix)
- [CVE-2026-101275](https://cve.now/CVE-2026-101275.md): Insufficient validation of payment status in pretix-adyen (CVSS 6.3, pretix-adyen)
- [CVE-2026-123717](https://cve.now/CVE-2026-123717.md): \[Eclipse CSI - otterdog\] OS Command Injection and Arbitrary Code Execution (CVSS 8.8, Eclipse CSI otterdog)
- [CVE-2026-125113](https://cve.now/CVE-2026-125113.md): XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern (CVSS 5.3, xrootd)
- [CVE-2026-125112](https://cve.now/CVE-2026-125112.md): djust cross-site scripting via template binding safety grant (CVSS 2.3, djust-org djust · djust)
- [CVE-2026-102289](https://cve.now/CVE-2026-102289.md): zizmor: Debug logging prints available GitHub credentials in cleartext (CVSS 7.0, zizmorcore zizmor · zizmor)
- [CVE-2026-125106](https://cve.now/CVE-2026-125106.md): Wagtail unauthorized read of source pages in translation API (CVSS 6.5, wagtail)
- [CVE-2026-125105](https://cve.now/CVE-2026-125105.md): Wagtail: Identification of documents by SHA1 hash (CVSS 3.7, wagtail)
- [CVE-2026-123820](https://cve.now/CVE-2026-123820.md): Wagtail: Improper restriction handling on descendant collections in Documents and Images API (CVSS 5.3, wagtail)
- [CVE-2026-123819](https://cve.now/CVE-2026-123819.md): Wagtail permission bypass in snippet copying (CVSS 6.5, wagtail)
- [CVE-2026-123818](https://cve.now/CVE-2026-123818.md): LMDeploy URL parser disagreement permits SSRF filter bypass (CVSS 7.5, InternLM lmdeploy · lmdeploy)
- [CVE-2026-123817](https://cve.now/CVE-2026-123817.md): AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads (CVSS 8.7, aio-libs aiohttp · aiohttp)
- [CVE-2026-123816](https://cve.now/CVE-2026-123816.md): pyLoad: Authentication bypass in API key validation (check\_apikey cache) (CVSS 8.1, pyload · pyload-ng)
- [CVE-2026-123815](https://cve.now/CVE-2026-123815.md): pyLoad device node creation via tar extraction (CVSS 9.4, pyload · pyload-ng)
- [CVE-2026-123814](https://cve.now/CVE-2026-123814.md): pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host (CVSS 6.4, pyload · pyload-ng)
- [CVE-2026-123813](https://cve.now/CVE-2026-123813.md): pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session (CVSS 7.5, pyload · pyload-ng)
- [CVE-2026-123806](https://cve.now/CVE-2026-123806.md): python-tuf case-sensitivity bypass in delegation path matching (CVSS 4.0, theupdateframework python-tuf · tuf)
- [CVE-2026-123796](https://cve.now/CVE-2026-123796.md): compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated \`.env\` (CVSS 2.3, tmatens compose-lint · compose-lint +1)
- [CVE-2026-123373](https://cve.now/CVE-2026-123373.md): compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output (CVSS 2.3, tmatens compose-lint · compose-lint +1)
- [CVE-2026-123372](https://cve.now/CVE-2026-123372.md): compose-lint secret leak in CL-0004 and CL-0019 findings (CVSS 2.3, tmatens compose-lint · compose-lint +1)
- [CVE-2026-123371](https://cve.now/CVE-2026-123371.md): compose-lint: A \`.compose-lint.yml\` symlinked outside the project is read, and a parse error quotes part of the target (CVSS 2.3, tmatens compose-lint · compose-lint +1)
- [CVE-2026-123370](https://cve.now/CVE-2026-123370.md): compose-lint: \`fix --apply\` can delete a line the user did not select, including a security setting (CVSS 5.1, tmatens compose-lint · compose-lint)
- [CVE-2026-123369](https://cve.now/CVE-2026-123369.md): compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action (CVSS 5.3, tmatens compose-lint · tmatens/compose-lint +1)
- [CVE-2026-123368](https://cve.now/CVE-2026-123368.md): compose-lint path traversal in .env loader (CVSS 2.3, tmatens compose-lint · compose-lint +1)
- [CVE-2026-123364](https://cve.now/CVE-2026-123364.md): OctoPrint: Stored XSS via saved connection parameters (CVSS 2.4, OctoPrint)
- [CVE-2026-40913](https://cve.now/CVE-2026-40913.md): Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement (CVSS 8.2, Apache Software Foundation apache-airflow-core)
- [CVE-2026-50204](https://cve.now/CVE-2026-50204.md): Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-68982](https://cve.now/CVE-2026-68982.md): Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation (CVSS 7.3, needs attention: First public exploit on GitHub Nov 11, Apache Software Foundation apache-airflow-core)
- [CVE-2026-76185](https://cve.now/CVE-2026-76185.md): Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode (CVSS 6.5, Apache Software Foundation apache-airflow-task-sdk)
- [CVE-2026-86829](https://cve.now/CVE-2026-86829.md): Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation (CVSS 8.8, Apache Software Foundation apache-airflow-core)
- [CVE-2026-82337](https://cve.now/CVE-2026-82337.md): Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization (CVSS 7.3, Apache Software Foundation apache-airflow-core)
- [CVE-2026-86468](https://cve.now/CVE-2026-86468.md): Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-96285](https://cve.now/CVE-2026-96285.md): Apache Airflow: Scheduler: next\_kwargs deserialized before the dict check, so resume data still invokes constructors (CVSS 8.8, Apache Software Foundation apache-airflow-core)
- [CVE-2026-113508](https://cve.now/CVE-2026-113508.md): Apache Airflow: Logout token revocation fails open; errors silently swallowed (CVSS 7.5, Apache Software Foundation apache-airflow-core)
- [CVE-2026-101031](https://cve.now/CVE-2026-101031.md): Apache Airflow: Shell command injection in the example\_dag\_decorator example Dag via an IPv6 zone identifier (CVSS 9.1, Apache Software Foundation apache-airflow-core)
- [CVE-2026-113504](https://cve.now/CVE-2026-113504.md): Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-107474](https://cve.now/CVE-2026-107474.md): Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111395](https://cve.now/CVE-2026-111395.md): Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline… (CVSS 8.2, Apache Software Foundation apache-airflow-core)
- [CVE-2026-111421](https://cve.now/CVE-2026-111421.md): Apache Airflow: Execution API: set\_xcom skips the reserved-key check, so task-written XComs instantiate airflow. classes on the API server (CVSS 8.8, Apache Software Foundation apache-airflow-core)
- [CVE-2026-111452](https://cve.now/CVE-2026-111452.md): Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111453](https://cve.now/CVE-2026-111453.md): Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag\_id query value but deletes rows for every readable Dag (CVSS 4.3, Apache Software Foundation apache-airflow-core)
- [CVE-2026-111454](https://cve.now/CVE-2026-111454.md): Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111455](https://cve.now/CVE-2026-111455.md): Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit (CVSS 6.5, Apache Software Foundation apache-airflow-core)
- [CVE-2026-123870](https://cve.now/CVE-2026-123870.md): \[Eclipse CSI - otterdog\] Unauthenticated remote code execution via eval() on format-string-injected webhook body when… (CVSS 9.5, Eclipse Foundation otterdog)
- [CVE-2026-103022](https://cve.now/CVE-2026-103022.md): Urwid: handle\_short\_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) (CVSS 5.3, urwid)
- [CVE-2026-102610](https://cve.now/CVE-2026-102610.md): fast-agent: \`fast-agent serve\` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote… (CVSS 6.4, evalstate fast-agent · fast-agent-mcp)
- [CVE-2026-55649](https://cve.now/CVE-2026-55649.md): GeoNode has Stored XSS in Documents metadata abstract field (CVSS 6.3, geonode)
- [CVE-2026-46429](https://cve.now/CVE-2026-46429.md): GeoNode: Unrestricted File Upload (CVSS 5.5, geonode)
- [CVE-2026-33050](https://cve.now/CVE-2026-33050.md): GeoNode: OS command injection via uploaded file layer name (CVSS 8.8, needs attention: First public exploit on GitHub Nov 11, geonode)
- [CVE-2026-123859](https://cve.now/CVE-2026-123859.md): SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) (CVSS 8.1, snowflake-connector-python)
- [CVE-2026-113663](https://cve.now/CVE-2026-113663.md): AG2: Newline injection in SandboxShellTool bypasses allowed=\[...\] and readonly=True, enabling arbitrary command execution (CVSS 8.8, ag2ai ag2 · ag2ai autogen +2)
- [CVE-2026-58273](https://cve.now/CVE-2026-58273.md): Rucio: Authorisation Bypass on REST API endpoint for signing URLs (CVSS 8.1, rucio)
- [CVE-2026-112908](https://cve.now/CVE-2026-112908.md): filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a… (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-112938](https://cve.now/CVE-2026-112938.md): filelock: StrictSoftFileLock follows a symbolic link swapped in at \<path\>.filelock and creates claim files in a directory another local… (CVSS 5.8, tox-dev filelock · filelock)
- [CVE-2026-112907](https://cve.now/CVE-2026-112907.md): filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break (CVSS 2.5, tox-dev filelock · filelock)
- [CVE-2026-112913](https://cve.now/CVE-2026-112913.md): filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database (CVSS 3.3, tox-dev filelock · filelock)
- [CVE-2026-112910](https://cve.now/CVE-2026-112910.md): filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-49272](https://cve.now/CVE-2026-49272.md): OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow (CVSS 8.5, oauthlib)
- [CVE-2026-48705](https://cve.now/CVE-2026-48705.md): MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (CVSS 9.3, Project-MONAI MONAI · monai)
- [CVE-2026-112902](https://cve.now/CVE-2026-112902.md): Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags (CVSS 8.3, python-pillow Pillow · pillow)
- [CVE-2026-112899](https://cve.now/CVE-2026-112899.md): Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit (CVSS 6.3, python-pillow Pillow · pillow)
- [CVE-2026-62268](https://cve.now/CVE-2026-62268.md): borg extract might modify out-of-tree files when extracting maliciously crafted archives (CVSS 5.3, borgbackup borg · borgbackup)
- [CVE-2026-114134](https://cve.now/CVE-2026-114134.md): Black: GitHub Action installs unvalidated required-version from pyproject.toml (CVSS 8.7, psf black · black)
- [CVE-2026-87008](https://cve.now/CVE-2026-87008.md): Code Graph RAG structural tools follow out-of-root symlinks (CVSS 7.1, vitali87 code-graph-rag · code-graph-rag)
- [CVE-2026-77604](https://cve.now/CVE-2026-77604.md): Code Graph RAG: MCP paginated read\_file path traversal / arbitrary file read (CVSS 7.5, vitali87 code-graph-rag · code-graph-rag)
- [CVE-2026-123036](https://cve.now/CVE-2026-123036.md): A flaw was found in ansible-core. (CVSS 5.5, Red Hat ansible-core)
- [CVE-2026-103002](https://cve.now/CVE-2026-103002.md): GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover (CVSS 8.8, gpustack)
- [CVE-2026-102894](https://cve.now/CVE-2026-102894.md): GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover (CVSS 9.1, gpustack)
- [CVE-2026-102895](https://cve.now/CVE-2026-102895.md): GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated… (CVSS 9.8, KEV, needs attention: Added to CISA KEV Nov 9; federal deadline Nov 12. Scores 85 on the cve.now Index; published Nov 4, gpustack)
- [CVE-2026-114456](https://cve.now/CVE-2026-114456.md): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers (CVSS 6.5, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-115878](https://cve.now/CVE-2026-115878.md): Stanza: RCE via pickle deserialization in the lemmatizer (CVSS 7.8, stanfordnlp stanza · stanza)
- [CVE-2026-121577](https://cve.now/CVE-2026-121577.md): Unescaped header separators in whatstk build a regular expression that backtracks exponentially (CVSS 6.7, lucasrodes whatstk)
- [CVE-2026-63471](https://cve.now/CVE-2026-63471.md): fastapi-code-generator: Import-time RCE via route path -\> unescaped @app.get('...') decorator (CVSS 9.3, koxudaxi fastapi-code-generator · fastapi-code-generator)
- [CVE-2026-63469](https://cve.now/CVE-2026-63469.md): fastapi-code-generator: Import-time RCE via response status-code key -\> unescaped @app.get(..., responses={...}) dict (CVSS 9.3, koxudaxi fastapi-code-generator · fastapi-code-generator)
- [CVE-2026-63470](https://cve.now/CVE-2026-63470.md): fastapi-code-generator: Call-time RCE via operation summary -\> unescaped route-handler docstring (CVSS 9.3, koxudaxi fastapi-code-generator · fastapi-code-generator)
- [CVE-2026-63417](https://cve.now/CVE-2026-63417.md): Logging Redactor: PII data in str/repr of non primitive objects was not being redacted (CVSS 8.2, armurox loggingredactor · loggingredactor)
- [CVE-2026-114582](https://cve.now/CVE-2026-114582.md): Server-side request forgery via SpatialReference string input (CVSS 5.3, djangoproject django)
- [CVE-2026-113733](https://cve.now/CVE-2026-113733.md): Password hash disclosure to "view only" admin users with custom user models (CVSS 2.2, djangoproject django)
- [CVE-2026-113593](https://cve.now/CVE-2026-113593.md): Potential exposure of private data via empty and missing Vary headers (CVSS 3.1, djangoproject django)
- [CVE-2026-111362](https://cve.now/CVE-2026-111362.md): Server-side request forgery via crs member of GeoJSON geometries (CVSS 5.3, djangoproject django)
- [CVE-2026-111211](https://cve.now/CVE-2026-111211.md): Potential log injection via unescaped geometry form values (CVSS 5.3, djangoproject django)
- [CVE-2026-108147](https://cve.now/CVE-2026-108147.md): Potential memory exhaustion in MultiPartParser via base64-encoded file upload (CVSS 5.3, djangoproject django)
- [CVE-2026-121564](https://cve.now/CVE-2026-121564.md): Silent loss of messages when merging overlapping chat exports in whatstk (CVSS 1.8, lucasrodes whatstk)
- [CVE-2026-118448](https://cve.now/CVE-2026-118448.md): Uninitialized output buffer returned after nd\_to\_text failure in pybddisasm (CVSS 6.9, Bitdefender pybddisasm)
- [CVE-2026-118447](https://cve.now/CVE-2026-118447.md): Uninitialized INSTRUX contents returned after decoding failure in pybddisasm (CVSS 4.8, Bitdefender pybddisasm)
- [CVE-2026-118446](https://cve.now/CVE-2026-118446.md): Use-after-free in INSTRUX array members in pybddisasm (CVSS 6.9, Bitdefender pybddisasm)
- [CVE-2026-118445](https://cve.now/CVE-2026-118445.md): Use-after-free in INSTRUX structure members in pybddisasm (CVSS 6.9, Bitdefender pybddisasm)
- [CVE-2026-118444](https://cve.now/CVE-2026-118444.md): Out-of-bounds reads during instruction decoding in pybddisasm (CVSS 4.8, Bitdefender pybddisasm)
- [CVE-2026-120492](https://cve.now/CVE-2026-120492.md): Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed\_urls (CVSS 6.3, Chainlit)
- [CVE-2026-118938](https://cve.now/CVE-2026-118938.md): Fickling check\_safety() bypass: dotted qualname in STACK\_GLOBAL resolves a class-method attribute path that evades call analysis (CVSS 8.8, trailofbits fickling)
- [CVE-2026-16760](https://cve.now/CVE-2026-16760.md): Fickling check\_safety() bypass: likely\_safe\_imports grants module-origin trust to unvalidated standard library callables (CVSS 8.8, trailofbits fickling)
- [CVE-2026-119286](https://cve.now/CVE-2026-119286.md): GraphQL-core: Denial of service via memory leak in aborted validations (CVSS 7.5, graphql-python graphql-core · graphql-core)
- [CVE-2026-119284](https://cve.now/CVE-2026-119284.md): joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection (CVSS 6.9, authlib joserfc · joserfc)
- [CVE-2026-119283](https://cve.now/CVE-2026-119283.md): joserfc: Unbounded JWE General JSON \`recipients\` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption (CVSS 7.5, authlib joserfc · joserfc)
- [CVE-2026-119209](https://cve.now/CVE-2026-119209.md): pypdf: Possible large memory usage when parsing cross-reference streams (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119208](https://cve.now/CVE-2026-119208.md): pypdf: Possible long runtimes/large memory usage for encrypted PDF files (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119207](https://cve.now/CVE-2026-119207.md): pypdf: Possible large memory usage for exceptions in strict mode (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119206](https://cve.now/CVE-2026-119206.md): pypdf: Possible long runtimes when retrieving page labels (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119205](https://cve.now/CVE-2026-119205.md): pypdf: Possible infinite loop when cloning dictionaries (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119204](https://cve.now/CVE-2026-119204.md): pypdf: Possible large memory usage when parsing page tree (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119203](https://cve.now/CVE-2026-119203.md): pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-119197](https://cve.now/CVE-2026-119197.md): pyasn1: Quadratic-complexity denial of service in binary REAL decoding (CVSS 7.5, pyasn1)
- [CVE-2026-119196](https://cve.now/CVE-2026-119196.md): pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding (CVSS 7.5, pyasn1)
- [CVE-2026-119195](https://cve.now/CVE-2026-119195.md): pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding (CVSS 7.5, pyasn1)
- [CVE-2026-119194](https://cve.now/CVE-2026-119194.md): pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding (CVSS 7.5, pyasn1)
- [GHSA-VPP8-G58W-M8MP](https://cve.now/GHSA-VPP8-G58W-M8MP.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset (high (no CVSS), twisted)
- [CVE-2026-118669](https://cve.now/CVE-2026-118669.md): OAuthLib: Token grants can use attacker-supplied client\_id for authorization after authenticating a different client (CVSS 8.4, oauthlib)
- [CVE-2026-118668](https://cve.now/CVE-2026-118668.md): LangGraph JavaScript custom authentication may permit cross-user Store access (CVSS 8.6, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-118667](https://cve.now/CVE-2026-118667.md): LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (CVSS 4.3, langchain-ai langgraph · langchain-ai langgraph-sdk +2)
- [CVE-2026-59177](https://cve.now/CVE-2026-59177.md): ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces (CVSS 8.8, esphome device-builder · esphome-device-builder)
- [CVE-2026-101272](https://cve.now/CVE-2026-101272.md): Incorrect session validation for API-created shredder exports (CVSS 2.3, pretix)
- [CVE-2026-101274](https://cve.now/CVE-2026-101274.md): When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate… (CVSS 6.9, pretix)
- [CVE-2026-101273](https://cve.now/CVE-2026-101273.md): Giftcard enumeration (CVSS 5.3, pretix)
- [CVE-2026-116690](https://cve.now/CVE-2026-116690.md): MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source (CVSS 7.5, mlflow)
- [CVE-2026-116677](https://cve.now/CVE-2026-116677.md): OpenWISP Controller CA CRL REST API does not scope requests to managed organizations (CVSS 5.3, openwisp-controller)
- [CVE-2026-116672](https://cve.now/CVE-2026-116672.md): Authlib RFC 7592 examples omit registration-access-token client binding (CVSS 8.8, authlib)
- [CVE-2026-117601](https://cve.now/CVE-2026-117601.md): Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions (CVSS 9.3, spesmilo electrum · electrum)
- [CVE-2026-116579](https://cve.now/CVE-2026-116579.md): Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) (CVSS 5.9, crossbario autobahn-python · autobahn)
- [CVE-2026-116578](https://cve.now/CVE-2026-116578.md): Tornado: Open redirect in RedirectHandler via protocol-relative URLs (CVSS 2.1, tornadoweb tornado · tornado)
- [CVE-2026-116577](https://cve.now/CVE-2026-116577.md): Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (CVSS 5.3, tornadoweb tornado · tornado)
- [CVE-2026-116575](https://cve.now/CVE-2026-116575.md): Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build\_session\_scope) (CVSS 6.3, mem0ai mem0 · mem0ai)
- [CVE-2026-115927](https://cve.now/CVE-2026-115927.md): Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (CVSS 5.3, tornadoweb tornado · tornado)
- [CVE-2026-115922](https://cve.now/CVE-2026-115922.md): ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs (CVSS 6.2, onnx)
- [CVE-2026-115921](https://cve.now/CVE-2026-115921.md): ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute (CVSS 6.2, onnx)
- [CVE-2026-115920](https://cve.now/CVE-2026-115920.md): ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank (CVSS 6.2, onnx)
- [CVE-2026-115919](https://cve.now/CVE-2026-115919.md): ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) (CVSS 6.2, onnx)
- [CVE-2026-115918](https://cve.now/CVE-2026-115918.md): vLLM: Responses API bypasses trust\_request\_chat\_template for chat\_template\_kwargs (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115917](https://cve.now/CVE-2026-115917.md): vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server (CVSS 3.4, vllm-project vllm · vllm)
- [CVE-2026-115916](https://cve.now/CVE-2026-115916.md): vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115915](https://cve.now/CVE-2026-115915.md): vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (CVSS 8.1, vllm-project vllm · vllm)
- [CVE-2026-115914](https://cve.now/CVE-2026-115914.md): vLLM DeepSeek-OCR image processing vulnerable to denial of service (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115913](https://cve.now/CVE-2026-115913.md): vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115912](https://cve.now/CVE-2026-115912.md): vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2026-115911](https://cve.now/CVE-2026-115911.md): vLLM: DoS via unbounded chat\_template Jinja2 rendering exhausts the renderer thread pool (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-115910](https://cve.now/CVE-2026-115910.md): Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the… (CVSS 6.8, python-social-auth social-core · social-auth-core)
- [CVE-2026-116178](https://cve.now/CVE-2026-116178.md): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-116177](https://cve.now/CVE-2026-116177.md): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-116176](https://cve.now/CVE-2026-116176.md): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-116173](https://cve.now/CVE-2026-116173.md): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output\_candidates.token\_ids (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-115885](https://cve.now/CVE-2026-115885.md): LangGraph CLI prints the registry push token in \`langgraph deploy --verbose\` output (CVSS 4.1, langchain-ai langgraph · langgraph-cli)
- [CVE-2026-114608](https://cve.now/CVE-2026-114608.md): Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT\_HOME (CVSS 5.4, pylint-dev pylint · pylint)
- [CVE-2026-114140](https://cve.now/CVE-2026-114140.md): nbconvert: File write via path traversal in cell output filenames (CVSS 8.8, jupyter nbconvert · nbconvert)
- [CVE-2026-114054](https://cve.now/CVE-2026-114054.md): vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2026-114052](https://cve.now/CVE-2026-114052.md): vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm\_processor\_kwargs (CVSS 8.7, vllm-project vllm · vllm)
- [PYSEC-2026-4320](https://cve.now/PYSEC-2026-4320.md): certifi bundles emSign root CAs with compromised intermediate CA keys (no CVSS, certifi)
- [CVE-2026-112941](https://cve.now/CVE-2026-112941.md): filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock (CVSS 3.3, tox-dev filelock · filelock)
- [CVE-2026-112939](https://cve.now/CVE-2026-112939.md): filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker (CVSS 4.7, tox-dev filelock · filelock)
- [CVE-2026-112936](https://cve.now/CVE-2026-112936.md): filelock: ReadWriteLock follows a symlink at the lock path into SQLite (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112935](https://cve.now/CVE-2026-112935.md): filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders (CVSS 4.7, tox-dev filelock · filelock)
- [CVE-2026-112934](https://cve.now/CVE-2026-112934.md): filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112915](https://cve.now/CVE-2026-112915.md): filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout (CVSS 5.5, tox-dev filelock · filelock)
- [CVE-2026-112912](https://cve.now/CVE-2026-112912.md): filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker (CVSS 2.5, tox-dev filelock · filelock)
- [CVE-2026-112911](https://cve.now/CVE-2026-112911.md): filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion (CVSS 6.3, tox-dev filelock · filelock)
- [CVE-2026-112909](https://cve.now/CVE-2026-112909.md): filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path (CVSS 6.1, tox-dev filelock · filelock)
- [CVE-2026-112396](https://cve.now/CVE-2026-112396.md): Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer (CVSS 5.9, python-pillow Pillow · pillow)
- [CVE-2026-105697](https://cve.now/CVE-2026-105697.md): Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration (CVSS 9.9, langflow-ai langflow · langflow-ai langflow-base +4)
- [CVE-2026-104851](https://cve.now/CVE-2026-104851.md): fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution (CVSS 8.8, fsspec filesystem\_spec · fsspec)
- [CVE-2026-75157](https://cve.now/CVE-2026-75157.md): Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) (CVSS 7.5, Apache Software Foundation apache-airflow · Apache Softw… +1)
- [CVE-2026-84380](https://cve.now/CVE-2026-84380.md): HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated (CVSS 5.6, pydantic httpx2 · httpx2)
- [CVE-2026-79657](https://cve.now/CVE-2026-79657.md): NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization (CVSS 9.3, nltk)
- [CVE-2026-18948](https://cve.now/CVE-2026-18948.md): Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server (CVSS 9.9, Red Hat OpenShift AI · feast)
- [CVE-2026-61536](https://cve.now/CVE-2026-61536.md): Banks: Unsafe importlib.import\_module of attacker-controlled Tool.import\_path in CompletionExtension allows RCE (CVSS 7.5, masci banks · banks)
- [CVE-2026-43637](https://cve.now/CVE-2026-43637.md): Cornac \< 2.6.0 Path Traversal via \_extract\_archive() in download.py (CVSS 8.8, PreferredAI cornac · cornac)
- [GHSA-7XW9-549R-8JRC](https://cve.now/GHSA-7XW9-549R-8JRC.md): DIRAC: SQL injection and lack of access control in PilotManager service (high (no CVSS), dirac)
- [GHSA-MXWC-WH95-PW4G](https://cve.now/GHSA-MXWC-WH95-PW4G.md): Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler (medium (no CVSS), trapster)
- [CVE-2026-7873](https://cve.now/CVE-2026-7873.md): Code Injection Vulnerability in Code Validation Endpoint (CVSS 9.9, IBM Langflow OSS · langflow)
- [CVE-2026-6658](https://cve.now/CVE-2026-6658.md): Cross-site Scripting (XSS) in jupyter/nbconvert (CVSS 5.4, jupyter/jupyter · nbconvert)
- [CVE-2026-56121](https://cve.now/CVE-2026-56121.md): Feast \< 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization (CVSS 9.3, feast-dev feast · feast)
- [CVE-2026-5366](https://cve.now/CVE-2026-5366.md): Git Argument Injection in prefecthq/prefect (CVSS 9.9, prefecthq/prefect · prefect)
- [CVE-2026-54017](https://cve.now/CVE-2026-54017.md): Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal (CVSS 7.7, open-webui)
- [CVE-2026-30898](https://cve.now/CVE-2026-30898.md): Apache Airflow: Bad example of BashOperator shell injection via dag\_run.conf (CVSS 8.8, Apache Software Foundation apache-airflow · Apache Softw… +1)
- [CVE-2026-39987](https://cve.now/CVE-2026-39987.md): marimo unauthenticated remote code execution in terminal websocket (CVSS 9.3, KEV, marimo-team marimo · marimo)
- [CVE-2026-22777](https://cve.now/CVE-2026-22777.md): ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler (CVSS 7.5, Comfy-Org ComfyUI-Manager · comfy-cli)
- [CVE-2025-63387](https://cve.now/CVE-2025-63387.md): Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature… (CVSS 4.3, Dify · dify-client)
- [CVE-2025-11201](https://cve.now/CVE-2025-11201.md): MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability (CVSS 8.1, MLflow)
- [CVE-2025-3248](https://cve.now/CVE-2025-3248.md): Langflow \< 1.3.0 Unauthenticated RCE via /api/v1/validate/code (CVSS 9.8, KEV, langflow-ai langflow · langflow +1)
- [CVE-2024-8859](https://cve.now/CVE-2024-8859.md): Path Traversal in mlflow/mlflow (CVSS 7.5, mlflow/mlflow · mlflow)
- [CVE-2024-12797](https://cve.now/CVE-2024-12797.md): RFC7250 handshakes with unauthenticated servers don't abort as expected (CVSS 7.4, OpenSSL · cryptography)
- [CVE-2024-3095](https://cve.now/CVE-2024-3095.md): langchain-ai/langchain server-side request forgery in Web Research Retriever (CVSS 4.8, langchain-ai/langchain · langchain-community)
- [CVE-2024-2057](https://cve.now/CVE-2024-2057.md): langchain\_community server-side request forgery in TFIDFRetriever (CVSS 6.3, langchain\_community · langchain-community)
- [CVE-2023-27524](https://cve.now/CVE-2023-27524.md): Apache Superset information disclosure in session validation (CVSS 8.9, KEV, Apache Software Foundation Apache Superset · superset +1)
- [CVE-2023-0286](https://cve.now/CVE-2023-0286.md): X.400 address type confusion in X.509 GeneralName (CVSS 7.4, OpenSSL · cryptography +1)
- [CVE-2022-2650](https://cve.now/CVE-2022-2650.md): wger-project/wger unlimited authentication attempts in login system (CVSS 7.8, wger-project/wger · wger)
- [CVE-2020-8927](https://cve.now/CVE-2020-8927.md): Buffer overflow in Brotli library (CVSS 5.3, Google Brotli · brotli +122)
- [CVE-2020-11651](https://cve.now/CVE-2020-11651.md): An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. (CVSS 9.8, KEV, salt)
- [CVE-2013-1840](https://cve.now/CVE-2013-1840.md): Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request (CVSS 6.5, Red Hat OpenStack Folsom for RHEL · Red Hat OpenStack Pl… +1)
- [CVE-2012-5625](https://cve.now/CVE-2012-5625.md): Openstack nova: information leak in libvirt lvm-backed instances (CVSS 6.5, Red Hat OpenStack Folsom for RHEL · Red Hat OpenStack Pl… +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.