Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

SummaryA Server-Side Request Forgery SSRF vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. DetailsWhen Cowrie operates in emulated shell mod...

PYSEC-2026-1616 MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability 500 errors until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank y...

Requests vulnerable to .netrc credentials leak via malicious URLs

ImpactDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. WorkaroundsFor older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs...

mezzanine (>=3.0.0, <=3.0.4) potentially affected by CVE-2024-47081 via requests (1.2.3)

requests PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - mezzanine =3.0.0, =3.0.4 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

128autograder (>=5.0.1, <=6.0.0rc4), 128autograder-python (6.0.0rc1) +12402 more potentially affected by CVE-2024-47081 via requests (>=2.0.0, <=2.32.3)

requests PYPI version =2.0.0, =5.0.1, =0.0.1a0, =0.1.1001, =0.1.0, =0.0.2, =0.0.5, =0.1.0, =0.1.0, =0.1.8 - a3m 0.1.0 and more Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

callllm (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-47081 via requests (0.13.7)

requests PYPI version 0.13.7 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - callllm =0.1.0, =0.1.1 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs

Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs. References...

PYSEC-2026-1713 OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

Impact OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run ...

cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (2.0.0)

django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...

GO-2026-5889 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the core process. An attacker can access internal network resources by sending specially crafted UDP requests that bypass access control checks. Remediation Upgrade github.com/apernet/hysteria/extras/v2/outboun...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the http process. An attacker can cause the server to become unresponsive by sending HTTP requests with excessively large headers, leading to resource exhaustion. Remediation Ther...

PYSEC-2026-1080 Aim Uncontrolled Resource Consumption vulnerability

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service DoS attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number o...

PYSEC-2026-1445 H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service DoS attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an...

PYSEC-2026-1457 HyperLPR Denial of Service vulnerability

A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service DoS attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malformed multipart requests with arbitrary...

H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service DoS attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an...

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

SummaryProblem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. DetailsIn the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

twisted.web has disordered HTTP pipeline response

SummaryThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC0. Start a fresh Debian container:shdocker run --workdir /repro --rm -it debian:bookworm-slim1. Install twisted and its dependencies:shap...

PYSEC-2026-1992 twisted.web has disordered HTTP pipeline response

Summary The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC 0. Start a fresh Debian container: sh docker run --workdir /repro --rm -it debian:bookworm-slim 1. Install twisted and its dependencies...

OpaMiddleware does not filter HTTP OPTIONS requests

SummaryHTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application.The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...