45636 matches found
mask-anonymization-framework (>=1.2.0, <=1.3.2), python-dev-tools (2019.8.24) +2 more potentially affected by CVE-2025-71176 via pytest (5.1.1)
pytest PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - mask-anonymization-framework =1.2.0, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...
databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-14279 via mlflow (2.20.2)
mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-14279 Source advisory: OSV:PYSEC-2026-1656...
Authlib has 1-click Account Takeover vulnerability
Security Advisory: Cache-Backed State Storage CSRF in AuthlibThe Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project.The Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in...
achoz (>=0.3.0, <=0.3.42), agentic-framework (>=0.3.0, <=0.3.11) +21 more potentially affected by CVE-2025-64512 via pdfminer-six (20191110.0.0)
pdfminer-six PYPI version 20191110.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - achoz =0.3.0, =0.3.0, =0.2.0, =0.0.1, =0.0.2, =0.4.0, =1.0.0, =0.1.0, =9.1.1, =6.0.0, =1.8.0, =0.1.0, =0.1.6 and more Source cves...
PYSEC-2026-1399 Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the decode function in fugue/rpc/flask.py directly uses cloudpickle.loads to deserialize data without any sanitization. This...
agentic-framework (>=0.2.0, <=0.2.5), bormeparser (>=0.4.0, <=0.4.1) +14 more potentially affected by CVE-2025-70559 via pdfminer-six (20181108.0.0)
pdfminer-six PYPI version 20181108.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - agentic-framework =0.2.0, =0.4.0, =0.0.1, =7.3.0, =0.2.0, =0.0.1, =1.0.0rc1, =0.3.0, =0.5.15, =0.2.0, =0.1.2, =1.0.0, =1.2.0 -...
PYSEC-2026-1868 reflex-dev/reflex has an Open Redirect vulnerability
Mitigation Make sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct: assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description --- Vulnerability Overview - When the GET /auth-codespace page loads in a GitHub...
Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
Vulnerable MobSF Versions: = v4.3.2Details:MobSF is a widely adopted mobile application security testing tool used by security teams across numerous organizations. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications...
PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...
directory-constants (>=21.0.1, <=21.0.2), djongo (1.3.7) +2 more potentially affected by CVE-2026-53878 via django (3.1.12)
django PYPI version 3.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-constants =21.0.1, =1.1.0rc0, =1.2.0 - rest-framework-djongo 0.1.7 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...
CVE-2026-56812
Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix Presence JavaScript client allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is...
CVE-2026-56812
The Phoenix JavaScript presence client suffers a client-side denial of service due to an unsafe existence check in Presence.syncState() and Presence.syncDiff(). By using a bare truthiness test (state[key]) to detect existing presences, attacker-controlled keys that collide with Object.prototype (...
CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix Presence JavaScript client allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is...
EEF-CVE-2026-56811 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service
Summary Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix Phoenix.Socket module allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport WebSocket or LongPoll...
CVE-2026-56811
Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix Phoenix.Socket module allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport WebSocket or LongPoll. This...
PYSEC-2026-1390 Frappe has possibility of SQL injection due to improper validations
Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue...
Frappe has possibility of SQL injection due to improper validations
ImpactAn SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. WorkaroundsUpgrading is required, no other workaround is present. CreditsThanks to Thanh of Calif.io for reporting the issue...
PYSEC-2026-1391 Frappe has possibility of SQL injection due to improper validations
Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present...
Feast Cross-Origin Resource Sharing vulnerability
A Cross-Origin Resource Sharing CORS vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security...