Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2026/04/07 1:16 p.m.21 views

PYSEC-2026-94

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to...

5.4CVSS5.8AI score0.00362EPSS
SaveExploits2References4Affected Software1
PyPA
PyPA
added 2026/03/13 7:55 p.m.21 views

PYSEC-2026-120

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

7.5CVSS6.8AI score0.00269EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/03/12 5:16 p.m.21 views

PYSEC-2026-118

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration allowAbsoluteUrls: true...

7.7CVSS5.9AI score0.00212EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2026/01/28 9:9 p.m.21 views

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...

5.8AI score
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2025/06/12 6:15 p.m.21 views

PYSEC-2025-220

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality...

9.8CVSS5.8AI score0.004EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2025/05/05 5:18 p.m.21 views

PYSEC-2025-179

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

9.1CVSS7.5AI score0.00819EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2025/04/22 6:15 p.m.21 views

PYSEC-2025-56

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential...

4.3CVSS7AI score0.00236EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2025/04/02 10:15 p.m.21 views

PYSEC-2025-196

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jitmodulefromflatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used...

5.5CVSS4.8AI score0.00262EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2025/03/20 10:15 a.m.21 views

PYSEC-2025-9

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

9.8CVSS8.2AI score0.05342EPSS
SaveExploits5References3Affected Software1
PyPA
PyPA
added 2021/07/06 12:15 p.m.21 views

PYSEC-2021-112

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry ACE to an access control list ACL that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process...

6.5CVSS7AI score0.01729EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2019/06/30 11:15 p.m.21 views

PYSEC-2019-257

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service crash due to a NULL pointer dereference by returning a crafted response that lacks a space character...

6.5CVSS6.8AI score0.02132EPSS
SaveExploits1References7
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token SummaryAuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

7.4CVSS5.6AI score
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

Anki's local HTTP server does not sufficiently validate requests

SummaryAnki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impactThe severity varies by...

8.7CVSS5.3AI score0.00179EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

SummaryThe multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user inp...

9.1CVSS5.8AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

SummaryThe published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:textpraisonai serve a2...

7.5CVSS5.4AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

SummaryAn unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. DetailsThe agentfile field in JobSubmitReque...

7.5CVSS5.5AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse"binds to 0.0.0.0 by default and builds its Starlette application with no authentication middlewareand no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controlsorigin...

9.8CVSS5.4AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

9.8CVSS6.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/14 4:17 p.m.20 views

PYSEC-2026-3452

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open to seek backwards to the same directive and parse it repeatedly in an infinite...

7.5CVSS6.1AI score0.00399EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

Summaryisglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny":pythondef...

4.9CVSS6.1AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

SummaryManually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts and allow-same-origin set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on...

7.3CVSS6.3AI score0.00194EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Langroid: handle_message() executes user-supplied tool JSON without sender verification

SummaryA Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Detailsenablemessage..., use=False, handle=True only prevents the LLM from being instructed to generate th...

8.1CVSS6.1AI score0.00278EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

ImpactRecce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API.When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

7.8CVSS6.1AI score
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Langroid: Path traversal in the file tools allows read/write outside configured current directory

SummaryLangroid's ReadFileTool and WriteFileTool appear to treat currdir as the intended working-directory boundary for file operations. However, the tools only change the process working directory to currdir and then operate on the user-supplied filepath without resolving and enforcing that the...

7.1CVSS6.1AI score0.00234EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda NULL pointer dereference when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::ReadReactionQualifierLines. Amalformed reaction qualifier record caused the parser to dereferencea NULL pointer. ImpactOpen...

5.5CVSS6.1AI score0.0019EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Lemur: JWT verifier honors attacker-supplied alg, enabling ATO

Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure Vulnerability Summary Field | Value-- | --Title | Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap;...

4.8CVSS6AI score
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

LangGraph SDK has unsafe URL path construction

Summarylanggraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addres...

9.1CVSS6AI score0.00216EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens SummaryThe local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbtplatformcontext endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt Clo...

6.8CVSS6.3AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

BBOT: Arbitrary File Write in postman_download Module

The postmandownload module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker...

6.5CVSS6.2AI score0.00251EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI: Stored XSS in Mermaid Markdown Preview

SummaryOpen WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML.Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working payload...

8.7CVSS6.2AI score0.00231EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

SummaryOpen WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin searchknowledgefiles tool.When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call searchknowledgefiles with an arbitrary knowledgeid...

4.3CVSS6.1AI score0.00259EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

RAG ACL Bypass in Milvus Multitenancy Mode SummaryThis is a bypass of the fix for:- GHSA-h36f-rqpx-j5wx- CVE-2026-44560- "Unauthorized File and Knowledge Base Content Access via RAG Vector Search"Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus...

6.5CVSS6.2AI score0.00335EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

SummaryAll temperature validation gates use comparison operators , which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that...

6.9CVSS6.2AI score0.0027EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via the Anthropic API routerResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchSeverity: CVSS 3.1 5.3 Medium AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTarget: https://github.com/vllm-project/vllm---...

9.8CVSS6.7AI score0.03723EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

pypdf: Possible large memory usage for form XObjects during text extraction

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. PatchesThis has been fixed in pypdf==6.12.2. WorkaroundsIf you cannot upgrade yet, consider applying the...

6.9CVSS6AI score0.00121EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

PDM: Project-Local State and Config Writes Follow Symlinks

SummaryPDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets.This creates an arbitrary file clobber primitive relative to the privileges of the...

6.8CVSS6.3AI score0.00151EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

WsgiDAV encoded dot segments can escape filesystem share roots

ImpactWsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. PatchesThe issue is fixed with version 4.3.4. PreconditionsThe practical impact depends on the deployment.The deployment use...

7.1CVSS6.1AI score0.00072EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

SummarySeveral Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...

5.8CVSS6.2AI score0.00047EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

SummaryPDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins.Th...

8.4CVSS6.5AI score0.00131EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Litestar has HTML Injection Through its CSRF Token

OverviewLitestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline wi...

8.1CVSS6AI score0.00284EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Bugsink: DOS using large numbers of event tags

SummaryIn affected versions, Bugsink stores every tag supplied with an incoming event. An event with an unusually large numberof custom i.e. supplied by an attacker tags can therefore make ingestion spend more time than intended writing tag rows.Bugsink uses a single-writer database architecture...

4.3CVSS6.1AI score0.00056EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

SummaryType: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on requireworkspacememberworkspaceid only, then resolve projectid through ProjectService.getprojectid / updateprojectid...

8.1CVSS6.1AI score0.00289EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A bug in Apache Airflow's Variable response masker caused nested-key redaction triggered by secret-suffixed key names like password, token, secret, apikey to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nest...

6.5CVSS6.1AI score0.00348EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID

SummaryPraisonAI Platform's workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID.The affected pattern...

8.8CVSS6AI score0.0029EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role

SummaryType: Authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member can remove any other member, including the workspace owner, using a single DELETE. There is ...

8.1CVSS6.1AI score0.00284EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

ImpactDNSCache.asyncadd inserted every response record into cache, expirations, expireheap, and servicecache with no cap on entry count. The only pre-existing protection was a PTR TTL floor DNSPTRMINTTL = 1125 s, RFC 6762 §10, which actually prolonged attacker-injected records, and a periodic...

6.5CVSS6.1AI score0.00241EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

A High severity Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads in...

7.8CVSS6.4AI score0.00022EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

SummaryA Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services e.g., AWS 169.254.169.254. This is a blind SSRF with confirmed internal port scanning...

6.5CVSS6.2AI score0.00209EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

📋 Reframing 2026-05-02: implicit unsafe remote-code path, not "supply-chain" The accurate description of this vulnerability is: "getmodelarch and related helpers hardcode trustremotecode=True with no opt-out, creating an implicit unsafe remote-code load path on every model fetch." What this repor...

7.8CVSS6.6AI score0.00148EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

SummaryThe SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parseurls API. An authenticated attacker can supply a URL pointing to an...

5CVSS6.2AI score0.00176EPSS
SaveExploits0References5Affected Software1
Total number of security vulnerabilities5000