PYSEC-2026-1538 LIEF is vulnerable to segmentation fault

A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parsebinary of the file src/ELF/Parser.tcc of the component ELF Binary Parser. The manipulation results in null pointer dereference. The attack must be initiated from a local...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2025-61783 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (0.8.3) potentially affected by CVE-2025-61783 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

rest-social-auth (>=1.3.0, <=1.4.0), saltdash (>=0.9.1, <=0.9.5) +1 more potentially affected by CVE-2025-61783 via social-auth-app-django (2.1.0)

social-auth-app-django PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - rest-social-auth =1.3.0, =0.9.1, =1.0.0rc1, =1.0.0rc8 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-19...

PYSEC-2026-2011 vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

Summary A Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows...

corradin-opioid-project (0.1.0), pricetool (0.1.0) potentially affected by CVE-2025-59842 via jupyterlab (0.31.1)

jupyterlab PYPI version 0.31.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - corradin-opioid-project 0.1.0 - pricetool 0.1.0 Source cves: CVE-2025-59842 Source advisory: OSV:PYSEC-2026-1482...

elyra (>=0.6.0, <=0.10.3), gcp-jupyterlab-shared (>=1.0.1, <=1.0.8) +5 more potentially affected by CVE-2025-59842 via jupyterlab (1.2.21)

jupyterlab PYPI version 1.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra =0.6.0, =1.0.1, =0.1.0, =1.0.1, =0.2.1, =0.1.0a16, =0.1.0a22 Source cves: CVE-2025-59842 Source advisory: OSV:PYSEC-2026-1482...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2025-6638 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2025-3777 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

edgy-project (>=0.1.12, <=0.1.15), fallixy (0.18.1) +5 more potentially affected by CVE-2025-47287 via tornado (4.4.3)

tornado PYPI version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - edgy-project =0.1.12, =0.18.1, =0.1.2, =0.9.0, =1.2.1 - pymultitor 2.1.0 Source cves: CVE-2025-47287 Source advisory: OSV:PYSEC-2026-1974...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2025-1194 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53877 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2026-48588 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-53878 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2026-48588 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-rest-authemail (>=1.7.9, <=2.0.0), umap-project (>=1.0.0rc2, <=1.0.0rc6) +1 more potentially affected by CVE-2026-48588 via django (2.1.1)

django PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rest-authemail =1.7.9, =1.0.0rc2, =0.1.0, =0.2.0.dev2 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-48588 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53878 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-rest-authemail (>=1.7.9, <=2.0.0), umap-project (>=1.0.0rc2, <=1.0.0rc6) +1 more potentially affected by CVE-2026-53877 via django (2.1.1)

django PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rest-authemail =1.7.9, =1.0.0rc2, =0.1.0, =0.2.0.dev2 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2026-53877 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2026-53877 Source advisory:...