40376 matches found
PYSEC-2026-1100 AIOHTTP vulnerable to denial of service through large payloads
Summary A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing. Impact If an application includes a handler that uses the Request.post method, an attacker may be able to freeze the server by exhausting the memory. ----- Patch:...
PYSEC-2026-1107 AIOHTTP vulnerable to DoS when bypassing asserts
Summary When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body. Impact If optimisations are enabled -O or PYTHONOPTIMIZE=1, and the application includes a handler that uses the Request.post method, then an attacker may be able to...
PYSEC-2026-1360 FastAPI Guard has a regex bypass
Summary The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. Details In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS...
CVE-2026-44938
creationtimestamp| type| source ---|---|--- 2026-07-07 15:37:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wp7phd52e...
CVE-2026-48588
creationtimestamp| type| source ---|---|--- 2026-07-07 15:02:03+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq2uqb2zhm2c 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:28:41+00:00| seen|...
PYSEC-2026-1541 LiteLLM Vulnerable to Remote Code Execution (RCE)
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
PYSEC-2026-1982 Transformers Regular Expression Denial of Service (ReDoS) vulnerability
A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...
Inefficient Regular Expression Complexity in langflow
A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remainingtext leads to...
PYSEC-2026-1779 PheonixAppAPI has visible Encoding Maps
Impact This is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc. The issue is that the map of encoding/decoding languages are visible in code. Patches The Problem was patched in 0.2.5, so you should try to upgrade to the...
CVE-2025-64636
creationtimestamp| type| source ---|---|--- 2026-07-07 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq2s64b4pj24...
CVE-2026-40187
creationtimestamp| type| source ---|---|--- 2026-07-07 14:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2s2h3gp32g 2026-07-07 14:35:10+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7...
GHSA-26V7-H57M-GH9M New API is vulnerable to CSRF through user email binding
Summary The email and WeChat account binding endpoints used GET requests for state-changing account operations. In deployments where session cookies could be sent on cross-site navigations, an attacker could trigger a logged-in user's browser to bind an attacker-controlled email address or OAuth...
CVE-2026-11340
creationtimestamp| type| source ---|---|--- 2026-07-07 11:56:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2keavs5r2n...
PYSEC-2026-1098 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
Summary An attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. Impact An attacker can stop the application from serving requests after sending a single...
PYSEC-2026-1650 mlflow Path Traversal vulnerability
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...
PYSEC-2026-1387 Path traversal in flaskcode
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...
PYSEC-2026-1249 Out of memory error when submitting the dataset form with a specially-crafted field
Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...
CVE-2026-48828
creationtimestamp| type| source ---|---|--- 2026-07-07 11:34:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2j5dmjes2x 2026-07-07 12:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2li2o6vg2w...
CVE-2026-11610
creationtimestamp| type| source ---|---|--- 2026-07-07 11:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2ipuz5va24 2026-07-08 01:23:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116881740056582551...