AIOHTTP vulnerable to DoS when bypassing asserts

SummaryWhen assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. ImpactIf optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to execu...

PYSEC-2026-1107 AIOHTTP vulnerable to DoS when bypassing asserts

Summary When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. Impact If optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to...

PYSEC-2026-1360 FastAPI Guard has a regex bypass

Summary The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. Details In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS...

CVE-2026-44938

creationtimestamp| type| source ---|---|--- 2026-07-07 15:37:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wp7phd52e...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-48588 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-48588 Source advisory:...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-53878 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-53878 Source advisory:...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-53877 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-53877 Source advisory:...

CVE-2026-48588

creationtimestamp| type| source ---|---|--- 2026-07-07 15:02:03+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq2uqb2zhm2c 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:28:41+00:00| seen|...

LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

PYSEC-2026-1541 LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

PYSEC-2026-1982 Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

Inefficient Regular Expression Complexity in langflow

A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remainingtext leads to...

PYSEC-2026-1779 PheonixAppAPI has visible Encoding Maps

Impact This is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc. The issue is that the map of encoding/decoding languages are visible in code. Patches The Problem was patched in 0.2.5, so you should try to upgrade to the...

PheonixAppAPI has visible Encoding Maps

ImpactThis is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc.The issue is that the map of encoding/decoding languages are visible in code. PatchesThe Problem was patched in 0.2.5, so you should try to upgrade to the...

CVE-2025-64636

creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...

CVE-2026-40187

creationtimestamp| type| source ---|---|--- 2026-07-07 14:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2s2h3gp32g 2026-07-07 14:35:10+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7...

GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding

Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...

CVE-2026-11340

creationtimestamp| type| source ---|---|--- 2026-07-07 11:56:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2keavs5r2n...

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

SummaryAn attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. ImpactAn attacker can stop the application from serving requests after sending a single...