GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter reflected DOM XSS...

PYSEC-2026-1402 GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter reflected DOM XSS...

PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...

Parsl Monitoring Visualization Vulnerable to SQL Injection

Affected Product: Parsl Python Parallel Scripting LibraryComponent: parsl.monitoring.visualizationVulnerability Type: SQL Injection CWE-89Severity: High CVSS Rating Recommended: 7.5 - 8.6URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.pySummaryA SQL Injection...

amundsen-metadata (>=2.5.5, <=3.5.0), bspider (>=0.0.5a0, <=0.0.8) +13 more potentially affected by CVE-2025-66221 via werkzeug (0.15.5)

werkzeug PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =2.5.5, =0.0.5a0, =1.3.1, =1.2.3, =0.1.3, =0.0.1, =0.0.9, =0.50.0, =1.0.6, =0.1.0, =4.2.0, =0.10.21, =0.15.37 Source cves:...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62801 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62801 Source advisory: OSV:PYSEC-2026-1365...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by CVE-2025-62800 via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: CVE-2025-62800 Source advisory: OSV:PYSEC-2026-1364...

LangGraph's SQLite store implementation has a SQL Injection Vulnerability

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators $eq, $ne, $gt, $lt, $gte, $lt...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2025-8869 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

PYSEC-2026-1088 Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

SummaryLanceDocChatAgent uses pandas eval through computefromdocs:https://github.com/langroid/langroid/blob/18667ec7e971efc242505196f6518eb19a0abc1c/langroid/vectorstore/base.pyL136-L150As a result, an attacker may be able to make the agent run malicious commands through QueryPlan.dataframecalc...

PYSEC-2026-2048 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query...

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-53877 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-53878 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-48588 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-allauth-ui (>=0.0.1, <=0.0.14), django-query-capture (>=0.1.0, <=0.2.6) +5 more potentially affected by CVE-2026-48588 via django (3.2.11)

django PYPI version 3.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-allauth-ui =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.0.2 - sphynxml 2.0.0 - workoutizer 0.24.0 Source cves: CVE-2026-48588 Source advisory:...

GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language DQL injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to brea...

CVE-2026-44628

A flaw was found in DCMTK. An unauthenticated attacker can send a specially crafted query to the worklist server. If the server meets specific conditions, including having a valid Called AE Title/storage directory, an expected lockfile, and at least one matching worklist record, this crafted quer...