CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

EUVD-2026-52867

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

CVE-2026-47781 affects PDM up to v2.26.9, where Core.init() calls load_plugins() and adds the project-local .pdm-plugins via site.addsitedir(). This causes .pth files to be processed, allowing attacker-controlled content in an untrusted repository checkout to execute arbitrary Python code before ...

CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

am-report (0.1.5), apexx (0.0.2) +11 more potentially affected by CVE-2026-15830 via django (4.2.13)

django PYPI version 4.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - am-report 0.1.5 - apexx 0.0.2 - ddaemon-core-python =0.5.1, =0.1.0, =4.6.5, =0.15.0, =0.1.5, =1.0.1, =0.1.4, =0.1.5.83 Source cves: CVE-2026-15830...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

EUVD-2026-52854

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

Eval Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Eval Injection via the CSVAgent process. An attacker can execute arbitrary code on the host system by injecting malicious input into the csvFile parameter, which is interpolated directly into a Python sourc...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code...