cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-33699 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-33699 Source advisory: OSV:PYSEC-2026-3012...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +60 more potentially affected by CVE-2026-33123 via pypdf (>=6.0.0, <=6.8.0)

pypdf PYPI version =6.0.0, =0.0.0, =1.0.0a3, =0.2.0, =3.1.0, =0.2.0, =0.2.0, =0.0.3, =6.2.61, =1.0.20, =0.12.0, =0.12.2 - calibreweb 0.6.26 and more Source cves: CVE-2026-33123 Source advisory: OSV:PYSEC-2026-3023...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-15031 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-33123 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-33123 Source advisory: OSV:PYSEC-2026-3023...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-31826 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-31826 Source advisory: OSV:PYSEC-2026-3019...

PYSEC-2026-2623 mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

Summary The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCPALLOWANONYMOUSACCESS=true is set required for the HTTP server to function without OAuth/API key,...

airflow-dbt-python (>=0.2.0, <=0.5.0), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +1 more potentially affected by CVE-2025-69219 via apache-airflow-providers-http (2.0.0)

apache-airflow-providers-http PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - airflow-dbt-python =0.2.0, =1.0.0b2, =1.0.0 - atlan-airflow-plugin 0.0.1 Source cves: CVE-2025-69219...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28804 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-28804 Source advisory: OSV:PYSEC-2026-3014...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-28351 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28351 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-28351 Source advisory: OSV:PYSEC-2026-3017...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27888 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-27888 Source advisory: OSV:PYSEC-2026-3027...

did-sdk-python (>=1.0.0, <=1.1.3), django-ninja-aio-crud (>=1.0.5, <=3.0.1) +9 more potentially affected by CVE-2026-27932 via joserfc (>=1.0.0, <=1.6.1)

joserfc PYPI version =1.0.0, =1.0.0, =1.0.5, =2.6.0, =2.1.1, =3.0.2, =0.21.2, =0.6.0, =0.9.0, =0.1.0, =0.5.0 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27628 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-27628 Source advisory: OSV:PYSEC-2026-3005...

PYSEC-2026-3067 Hugging Face Smolagents has a Server-Side Request Forgery issue

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27026 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-27026 Source advisory: OSV:PYSEC-2026-3015...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27025 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-27025 Source advisory: OSV:PYSEC-2026-3024...

Hugging Face Smolagents has a Server-Side Request Forgery issue

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-27024 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-27024 Source advisory: OSV:PYSEC-2026-3013...

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

ImpactCritical Sandbox Escape & Server Takeover:A critical security vulnerability exists in mcp-run-python due to a lack of isolation between the Python runtime Pyodide and the host JavaScript environment.The runPython and runPythonAsync functions execute Python code using Pyodide without...

repository-manager (>=1.2.10, <=1.2.15) potentially affected by CVE-2026-25905 via mcp-run-python (0.0.22)

mcp-run-python PYPI version 0.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-run-python and may be impacted: - repository-manager =1.2.10, =1.2.15 Source cves: CVE-2026-25905 Source advisory: OSV:PYSEC-2026-2628...