plainqafact (>=0.4.0, <=1.1.0), python-fhir-converter (0.0.21) potentially affected by CVE-2026-55865 via python-liquid (1.10.2)

python-liquid PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - plainqafact =0.4.0, =1.1.0 - python-fhir-converter 0.0.21 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

pharia-data-sdk (>=0.1.1, <=0.1.6), pharia-inference-sdk (>=0.1.2, <=0.1.6) +1 more potentially affected by CVE-2026-55865 via python-liquid (1.9.4)

python-liquid PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - pharia-data-sdk =0.1.1, =0.1.2, =0.1.0, =0.1.7 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

python-fhir-converter (0.0.22) potentially affected by CVE-2026-55865 via python-liquid (1.11.0)

python-liquid PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter 0.0.22 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +2 more potentially affected by CVE-2026-55865 via python-liquid (1.13.0)

python-liquid PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - blrec =1.8.0a3, =0.26.6rc0, =0.8.0, =0.0.1, =0.0.20 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

python-fhir-converter (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-55865 via python-liquid (1.12.1)

python-liquid PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-liquid and may be impacted: - python-fhir-converter =0.1.0, =0.3.0 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

pharia-inference-sdk (0.1.0), solace-agent-mesh (>=1.8.0, <=1.28.4) potentially affected by CVE-2026-55865 via python-liquid (>=2.0.2, <=2.2.0)

python-liquid PYPI version =2.0.2, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: OSV:PYSEC-2026-3035...

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

ImpactGiven a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. PatchesThe issue is fixed in...

PYSEC-2026-3035 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

PYSEC-2026-2860 pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

PYSEC-2026-3408 vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via the Anthropic API router Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Severity: CVSS 3.1 5.3 Medium AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Target: https://github.com/vllm-project/vllm ---...

PYSEC-2026-3025 pypdf: Manipulated XMP metadata streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. Patches This has been fixed in pypdf==6.12.1. Workarounds If you cannot upgrade yet, consider applying the change...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-49461 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-49461 Source advisory: OSV:PYSEC-2026-3020...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48735 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-48735 Source advisory: OSV:PYSEC-2026-3025...

agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-54531 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-54531 Source advisory: OSV:PYSEC-2026-3022...

PYSEC-2026-3036 python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

Summary When parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the...

PYSEC-2026-3037 python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Summary QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes...

diagram-to-iac (>=1.0.10, <=1.18.0), portia-sdk-python-rfares (0.4.10) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.16)

langchain-anthropic PYPI version 0.3.16 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - diagram-to-iac =1.0.10, =1.18.0 - portia-sdk-python-rfares 0.4.10 Source cves: CVE-2026-55443 Source advisory:...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-54530 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-54530 Source advisory: OSV:PYSEC-2026-3009...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-54531 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-54531 Source advisory: OSV:PYSEC-2026-3022...

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

SummaryQuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes a...