Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2026/07/13 3:35 p.m.15 views

Apache Airflow has an Improper Authorization issue

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

3.1CVSS6.1AI score0.00477EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.15 views

BoxLite has a Timeout Bypass Vulnerability

SummaryBoxLite is a sandbox service that allows users to create lightweight virtual machines Boxes and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the...

6.5CVSS6.1AI score0.00268EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

SummaryThe compliance-trestle library's profile import mechanism resolves trestle:// URIs and relative file paths by joining them with trestleroot and calling .resolve, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious...

6.9CVSS6.2AI score0.00061EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

SummaryAmazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

7.2CVSS6.6AI score0.0039EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

ModelScope is vulnerable to arbitrary code injection via a crafted module

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file deymini.yaml under the key 'nnet''module'...

8.1CVSS6.3AI score0.00522EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

SummaryTwo FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log ...

5.3CVSS6.2AI score0.00343EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

Weblate: Stored HTML injection in editor search preview

ImpactWeblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. Patches...

4.6CVSS6.1AI score0.00208EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

SummaryThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLECODEEXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. DetailsThe admi...

8.8CVSS7.5AI score0.00406EPSS
SaveExploits2References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

SummaryAn internal-only bypassfilter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypassfilter=true and bypass model access control checks to invoke admin-restricted models...

5.4CVSS6.3AI score0.00193EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.15 views

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. SummaryThe channel webhook create/update flow accepts arbitrary...

7.4CVSS6.6AI score0.0022EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

mem0 server lacks authentication and authorization controls for its memory creation API endpoint

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

5.3CVSS6.2AI score0.00335EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks

Docling's METS GBS backend is vulnerable to XML Entity Expansion XXE attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromstring without disabling entity resolution. An attacker can craft a malicious XML file with nested entity definitions XML Bo...

7.5CVSS6AI score0.00278EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

pgAdmin 4 File Manager has symbolic-link path traversal

Symbolic-link path traversal CWE-61, CWE-22 in pgAdmin 4 File Manager.checkaccesspermission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage...

8.1CVSS7AI score0.00359EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

A vulnerability in the createmodelversion handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag...

7.5CVSS7.1AI score0.00712EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities

Local file inclusion LFI and server-side request forgery SSRF vulnerabilities in pgAdmin 4 LLM API configuration endpoints.User-supplied apikeyfile and apiurl preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by...

7.1CVSS6.2AI score0.00217EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

SummaryPraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. DetailsThe vulnerable server is the shipped...

7.3CVSS7.1AI score0.28571EPSS
SaveExploits3References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

Open WebUI has inconsistent authorization controls within memories API

SummaryAuthorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delete, restore, and view the contents of other users' memories. DetailsUsing a newly created non-admin user with no existing memories, it is possible to view existing...

8.3CVSS6.1AI score0.00294EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

Summarybanks = 2.4.1 uses jinja2.Environment unsandboxed to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt are vulnerable to Server-Side Template Injection SSTI, which can lead to Remote Code Execution RCE on the host system.This is a...

7.5CVSS6.3AI score0.00539EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Global Knowledge Base Enumeration via knowledge-bases Meta-Collection Affected ComponentRetrieval collection access validation:- backend/openwebui/routers/retrieval.py lines 2330-2355, validatecollectionaccess- backend/openwebui/routers/retrieval.py query endpoints, e.g. POST /query/doc Affected...

4.3CVSS6.2AI score0.00221EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Description OverviewLemur's LDAP authentication module lemur/auth/ldap.py constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries...

8.1CVSS6.2AI score0.00179EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token which provides access to all OpenStack services Ironic is authorized for; o...

7.7CVSS6.1AI score0.00433EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.15 views

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

SummaryThis report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during...

7.5CVSS6.2AI score0.00414EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API

A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/apiserver/openairoutes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to...

2.6CVSS5.4AI score0.00162EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

ImpactAn attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. PatchesPatched version: 12.2.0.PdfParser introduced in Pillow 4.2.0 follows Prev pointers in PDF trailers to read cross-reference sections. If...

5.5CVSS6.9AI score0.00126EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

SGLang has an Improper Input Validation/Injection Issue

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function gettokenizer of the file python/sglang/srt/utils/hftransformersutils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A hi...

6.3CVSS5.8AI score0.00368EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

5CVSS5.4AI score0.0025EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Prefect Unauthenticated Event Injection via /api/events/in WebSocket

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

7.5CVSS6.4AI score0.00421EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Prefect Git Argument Injection in GitRepository Pull Steps

A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commitsha/directories results in argument injection. It is...

6.5CVSS6.3AI score0.00247EPSS
SaveExploits0References11Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

ImpactA stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction.The...

8.4CVSS6.3AI score0.00476EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

django-mdeditor is Missing Authentication for Critical Function

All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file...

9.8CVSS6.5AI score0.00308EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

mkdocs-mcp-plugin has a Path Traversal issue

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function readdocument/listdocuments of the file server.py. Performing a manipulation of the argument docsdir/filepath results in path traversal. The attack is possible to be carried out remotely. The exploit has...

7.5CVSS6.6AI score0.00426EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

mcp-url-downloader has a Server-Side Request Forgery issue

A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function validateurlsafe of the file src/mcpurldownloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack...

7.5CVSS6.6AI score0.00294EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

4.6CVSS6.5AI score0.00144EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

AgentScope Vulnerable to Remote Code Injection

A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function executepythoncode/executeshellcommand of the file src/AgentScope/tool/coding/python.py. This manipulation causes code injection. The attack is possible to be carried out remotely...

7.5CVSS6.6AI score0.00311EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsetting...

5.3CVSS5.7AI score0.00152EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

SummaryThe DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

8.3CVSS6.3AI score0.00265EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue...

7.5CVSS6.1AI score0.00426EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/exposestacktraces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue...

7.5CVSS6.1AI score0.00449EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

9.8CVSS6.2AI score0.00347EPSS
SaveExploits2References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

uefi-firmware contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefifirmware/compression/Tiano/Decompress.c, ReadCLen reads Number = GetBitsSd, CBIT with CBIT = 9, so Number can be as large as 511, while the destination array Sd-mCLen has NC = 510 elements...

9.8CVSS7AI score
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Apache Airflow: JWT token appearing in logs

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.Users are recommended to upgrade to version 3.2.0, which fixes this issue...

7.5CVSS6.1AI score0.00739EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

MetaGPT affected by server-side request forgery in metagpt/utils/common.py

A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.2. This impacts the function decodeimage of the file metagpt/utils/common.py. The manipulation of the argument imgurlorb64 results in server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

6.5CVSS6.4AI score0.00263EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

ajenti.plugin.core has race conditions in 2FA

ImpactIf the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. PatchesThis is fixed in the version 0.112. Users should upgrade to this version as soon as possible...

9.1CVSS6.1AI score0.00232EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Keras has an untrusted deserialization vulnerability

A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safemode=True. This bypasses the security guarantees of safemode and enables arbitrary attacker-controlled...

8.8CVSS7.3AI score0.00405EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

MetaGPT has an eval injection via a cross-site request forgery attack

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack...

8.8CVSS5.7AI score0.00224EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:2 p.m.15 views

Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble

Authenticated arbitrary file write in artifact bundle assembly SummaryAn authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow.A user with a valid authentication token could cause the application to write attacker-controlled content to a...

7.1CVSS6.4AI score0.00299EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.15 views

PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

SummaryThe gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, an attacker can cause the ExecApprovalManager to...

7.9CVSS6.3AI score0.00227EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.15 views

PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

SummaryThe WSGI-based recipe registry server server.py reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default no token configured, any local process can send arbitrarily large PO...

7.5CVSS6.2AI score0.00334EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.15 views

PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits

SummaryThe safeextractall function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall. An attacker can publish a malicious recipe bundle...

6.5CVSS6.2AI score0.00243EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.15 views

OpenEXR Makes Use of Uninitialized Memory

SummaryWhile fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on uninitialized data inside genericunpack. This indicates a use of uninitialized memory CWE-457. The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC. DetailsEnvironment:-...

7.5CVSS7AI score0.00382EPSS
SaveExploits1References10Affected Software1
Total number of security vulnerabilities5000