EUVD-2026-75804

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836 psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836

psd-tools (Python library for Adobe Photoshop PSD files) is vulnerable to arbitrary file write and arbitrary file read via unsanitized smart-object paths. In all releases through v1.17.0 , SmartObject.save() uses the embedded filename from the PSD verbatim—no basename, no .. filtering, no absolut...

CVE-2026-81211

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary Python code execution by a remote authenticated attacker. The root cause is a missing authorization check (CWE-862): the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY policy is enforced on the direct custom-component endpoint but n...

CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

CVE-2026-81211

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

Malicious code in lucy-python-script-2030 (PyPI)

Source: kam193 0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891 Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the co...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87015 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87015 Source advisory: SNYK:PYTHON-OPENWEBUI-20158702...

Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-16125 Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

FVO-ORACLE

FVO-ORACLE Custom Python vulnerability scanner with AI-powe...

CVE-2026-88029

A flaw was found in the GridFS component of the MongoDB Python Driver pymongo. The driver can treat a caller-supplied structured file identifier as a MongoDB query condition instead of a literal identifier. An authenticated user who can influence the identifier passed to GridFS download, delete, ...

DEBIAN-CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

UBUNTU-CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88029

CVE-2026-88029 is a query-operator injection vulnerability in the GridFS component of the MongoDB Python Driver . An improper neutralization of special elements in data query logic allows a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal ide...

CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...