fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: MEND:CVE-2026-27953...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: GHSA-F964-WHRQ-44H8...

fastapi-helpers (>=0.0.1, <=0.2.3), fastapi-users-db-ormar (1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.7.1, <=0.20.2)

ormar PYPI version =0.7.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: OSV:GHSA-F964-WHRQ-44H8...

CVE-2026-27953: Improperly Controlled Modification of Dynamically-Determined Object Attributes

ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...

CVE-2026-32632: Origin Validation Error

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

CVE-2026-26929

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dagid set to "" wildcard for all DAGs. As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users ar...

CVE-2026-26929: Incorrect Permission Assignment for Critical Resource

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dagid set to "" wildcard for all DAGs. As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users ar...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.6.2) +174 more potentially affected by CVE-2026-28498 via authlib (>=1.0.0b2, <=1.6.8)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.22.0 and more Source cves: CVE-2026-28498 Source advisory: GHSA-M344-F55W-2M6J...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-28498 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-28498...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-28490 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-28490...

GHSA-7432-952R-CW78 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Executive Summary A cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registers RSA15 in its default algorithm registry without requiring explicit opt-in,...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.6.2) +174 more potentially affected by CVE-2026-27962 via authlib (>=1.0.0b2, <=1.6.8)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.22.0 and more Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-27962 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-27962...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:PYSEC-2026-132...

casbin-couchbase-adapter (>=0.1.3, <=0.1.4), fastapi-authz (0.0.3) +1 more potentially affected by CVE-2026-32640 via simpleeval (0.9.10)

simpleeval PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on simpleeval and may be impacted: - casbin-couchbase-adapter =0.1.3, =2.0.0, =2.4.0 Source cves: CVE-2026-32640 Source advisory: OSV:PYSEC-2026-132...

casbin-couchbase-adapter (>=0.1.3, <=0.1.4), fastapi-authz (0.0.3) +1 more potentially affected by CVE-2026-32640 via simpleeval (0.9.10)

simpleeval PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on simpleeval and may be impacted: - casbin-couchbase-adapter =0.1.3, =2.0.0, =2.4.0 Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: SNYK:PYTHON-SIMPLEEVAL-15610288...

evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)

simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: GHSA-44VG-5WV2-H2HG...

Malicious code in fastapi-middleware-cors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 305178589615e2247b892b3e305e5fd69a0fc02092f0b115b6b384441f5ddd46 Library disguised as FastAPI helper is executing obfuscated code during importing the module. The code is highly obfuscated; the code seems to contain an...