EUVD-2026-86347

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters...

EUVD-2026-92844

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features...

GHSA-PH72-CQR5-QPP7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

EUVD-2026-75665

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

CVE-2026-105761

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps//server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to t...

EUVD-2026-92852

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

dbt-schema-builder (>=0.4.3, <=0.4.4), dbt-snowflake (>=1.0.0rc1, <=1.0.1) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.10)

snowflake-connector-python PYPI version 2.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-schema-builder =0.4.3, =1.0.0rc1, =0.1.1, =0.2.7 - elementary-lineage 0.1.0 Source cves: CVE-2026-86597...

meltanolabs-tap-snowflake (>=0.2.0, <=0.3.0), snowflake-data-exchange-agent (>=0.0.21, <=1.0.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (3.17.4)

snowflake-connector-python PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - meltanolabs-tap-snowflake =0.2.0, =0.0.21, =1.0.1 Source cves: CVE-2026-86597 Source advisory:...

org.apache.nifi:nifi-snowflake-processors (2.8.0), org.apache.nifi:nifi-snowflake-processors-nar (2.8.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.28.0)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - org.apache.nifi:nifi-snowflake-processors 2.8.0 -...

io.github.zoom-dustin-moriarty:zoom-data-fence (1.0.0), net.snowflake:snowflake-ingest-sdk (>=4.0.1-unshaded, <=4.1.0-unshaded) +1 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.24.2)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - io.github.zoom-dustin-moriarty:zoom-data-fence 1.0.0 - net.snowflake:snowflake-ingest-sdk...