60138 matches found
PYSEC-2026-2045 Werkzeug safe_join not safe on Windows
On Python = 3.11, or not using Windows, are not vulnerable...
PYSEC-2026-1266 Composio Code Injection Vulnerability
A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...
PYSEC-2026-1321 D-Tale Command Execution Vulnerability
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route"/chart-data/", the query parameters from the request are directly passed into runquery for execution. And...
PYSEC-2026-1432 Guardrails has an arbitrary code execution vulnerability
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing i...
PYSEC-2026-1870 Refuel Autolab Eval Injection vulnerability
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...
PYSEC-2026-1629 MindsDB Eval Injection vulnerability
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration...
PYSEC-2026-1917 Sentry's Python SDK unintentionally exposes environment variables to subprocesses
Impact The bug in Sentry's Python SDK subprocess.checkoutput"env", env="TEST":"1" b'TEST=1\n' If you'd want to not pass any variables, you can set an empty dict: subprocess.checkoutput"env", env= b'' However, the bug in Sentry SDK 2.8.0 causes all environment variables to be passed to the...
PYSEC-2026-2074 zipp Denial of Service vulnerability
A Denial of Service DoS vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the...
PYSEC-2026-1584 Remote Code Execution in create_conda_env function in lollms
A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...
ROOT-APP-PYPI-CVE-2026-27932 CVE-2026-27932 in rootio-joserfc - Patched by Root
Root has patched CVE-2026-27932 in the rootio-joserfc package for Root:PyPI. Multiple fixed versions available...
MAL-2026-7466 Malicious code in scan-checker (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7467 Malicious code in scanvia (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7465 Malicious code in quatre (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7464 Malicious code in pygremlinbox-malware-network-indicators (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7462 Malicious code in pygremlinbox-malware-cryptomining-indicators (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7463 Malicious code in pygremlinbox-malware-install-execution (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7460 Malicious code in pygremlinbox-malware-code-obfuscation (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7459 Malicious code in pygremlinbox-malware-c2-beacon (PyPI)
--- -= Per source details. Do not edit below this line.=-...
