ggshield v1.54.0-rc1

ggshield: protect your code with GitGuardian ggshield is a CLI application that runs in your local environment or in a CI environment to help you detect more than 500+ types of secrets. ggshield uses our public API through py-gitguardian to scan and detect potential vulnerabilities in files and...

libp2p: yamux connection DoS via oversized data frame

SummaryThe yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop t...

PT-2026-80654

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

CVE-2026-49452: Improper Neutralization of Special Elements in Output Used by a Downstream Component

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...

CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-73568

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:10+00:00| published-proof-of-concept| https://github.com/libp2p/py-libp2p/security/advisories/GHSA-hmj8-5xmh-5573...

CVE-2026-73568

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

EUVD-2026-58183

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568

py-libp2p (Python implementation of libp2p) before 0.7.0 has a yamux handle_incoming() flaw in libp2p/stream_muxer/yamux/yamux.py: it reads a 32-bit DATA frame length with read_exactly() before validating against MAX_WINDOW_SIZE or checking stream_id. A peer completing the Noise handshake can sen...

CVE-2026-73568 py-libp2p: yamux connection DoS via oversized data frame

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

CVE-2026-73568: Uncontrolled Resource Consumption

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...

Malicious Package

Overview defi-sdk-py is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

ROOT-APP-PYPI-CVE-2025-66416 CVE-2025-66416 in mcp - Patched by Root

Root has patched CVE-2025-66416 in the mcp package for Root:PyPI. Multiple fixed versions available...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...