CVE-2025-64636

creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...

CVE-2026-53483

creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...

External Control of File Name or Path

Overview egroupware/egroupware is a library that extends a classic groupware with an integrated CRM-system, a secure file-server and Collabora Online Office. Affected versions of this package are vulnerable to External Control of File Name or Path via the processURL2InlineImages process. An...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the notification URL validation process. An attacker can access internal network resources and potentially expose sensitive internal data by configuring notification URLs to point to hostnames that...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the notification URL validation process. An attacker can access internal network resources and potentially expose sensitive internal data by configuring notification URLs to point to hostnames that...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the notification URL validation process. An attacker can access internal network resources and potentially expose sensitive internal data by configuring notification URLs to point to hostnames that...

PYSEC-2026-1413 Server-Side Request Forgery in gradio

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is us...

PYSEC-2026-2043 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it...

gradio Server-Side Request Forgery vulnerability

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...

Docassemble unauthorized access through URL manipulation

ImpactThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. PatchesThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...

PYSEC-2026-1817 pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

Summary Open redirect vulnerability due to incorrect validation of input values when redirecting users after login. Details pyload is validating URLs via the getredirecturl function when redirecting users at login. The URL entered in the next variable goes through the issafeurl function, where a...

PYSEC-2026-1509 langchain Server-Side Request Forgery vulnerability

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

langchain Server-Side Request Forgery vulnerability

With the following crawler configuration:pythonfrom bs4 import BeautifulSoup as Soupurl = "https://example.com"loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.loadAn attacker in control of the contents of https://example.com could place...

PYSEC-2026-1340 Fides JavaScript Injection Vulnerability in Privacy Center URL

Impact The Fides web application allows users to edit consent and privacy notices such as cookie banners. These privacy notices can then be served by other integrated websites, for example in cookie consent banners. One of the editable fields is a privacy policy URL and this input was found to no...

PYSEC-2026-2063 yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

Impact The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. To pass extra control data between...

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

ImpactThe Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases.To pass extra control data between...

PYSEC-2026-1508 Langchain Server-Side Request Forgery vulnerability

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

PYSEC-2026-1969 TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

Summary The torbot.modules.validators.validatelink function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument.. Details...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2023-35934 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2023-35934 Source advisory: OSV:PYSEC-2026-2067...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2023-35934 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2023-35934 Source advisory: OSV:PYSEC-2026-2067...