CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029

CVE-2026-88029 is a query-operator injection vulnerability in the GridFS component of the MongoDB Python Driver . An improper neutralization of special elements in data query logic allows a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal ide...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

PYSEC-2026-3969

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

PYSEC-2026-3969

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

USN-8744-1 python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.14 vulnerabilities

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu...

USN-8744-1: Python vulnerabilities

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu...

ROOT-APP-PYPI-CVE-2026-41205 CVE-2026-41205 in mako - Patched by Root

Root has patched CVE-2026-41205 in the mako package for Root:PyPI. Multiple fixed versions available...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-78679 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-78679 Source advisory: OSV:PYSEC-2026-3837...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-78679 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

PYSEC-2026-3907 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3908 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

SummaryAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.When the tool is invoked, the runner imports and...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-84311 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-84309 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....