Lucene search
+L
PypaMost viewed

7250 matches found

PyPA
PyPA
added 2026/06/30 8:12 p.m.15 views

Malicious code in executor-http (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of executor-http were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...

5.9AI score
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/06/29 4:24 p.m.15 views

Malicious code in nhmpy (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of nhmpy were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...

5.9AI score
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

SummaryType: Privilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" and forwards the request body's userid and role straight into MemberService.addworkspaceid, userid, role...

9.6CVSS6AI score0.00209EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Codechecker has an authentication bypass for certain API calls

SummaryAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker. DetailsThe following functions are affected under the Authentication endpoint: getAuthorisedNames,...

10CVSS6.2AI score0.00447EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

9.9CVSS6.2AI score0.00272EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

llm CLI tool contains a code injection vulnerability via `--functions` command-line argument

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec function...

9.8CVSS6.5AI score0.00327EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

SGLang's multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads will be deserialized without validation...

9.8CVSS6.6AI score0.00585EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

SummaryThe fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parsemcpcommand, allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. Affected Package- Ecosystem: PyPI-...

9.8CVSS6.8AI score0.00824EPSS
SaveExploits2References7Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

SummaryMarimo 19.6k stars has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.Unlike other WebSocket endpoints e.g., /ws that correctly...

9.8CVSS7.6AI score0.96576EPSS
SaveExploits18References10Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Remote Code Execution due to Full Controled File Write in mlflow

The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...

10CVSS7.6AI score0.47594EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Ray has arbitrary code execution via jobs submission API

Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

9.8CVSS7.4AI score0.83942EPSS
SaveExploits6References17Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

9.8CVSS7.5AI score0.01307EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Ckan remote code execution and private information access via crafted resource ids

Specific vulnerabilities: Arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also reachable via packagecreate, packagerevise, and packagepatch via calls to packageupdate. Remote code execution via unsafe pickle loading, via Beaker's session store...

9.8CVSS7.8AI score0.01684EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

ImpactAttackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE.When axis is larger than the dim of input, c-Diminput,axis goes out of bound.Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad...

9.8CVSS6.7AI score0.00831EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

qdrant input validation failure

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the...

9.8CVSS7.3AI score0.00901EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

CraftBeerPi 4 allows arbitrary code execution

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4:...

9.8CVSS6.2AI score0.01139EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

llama-index-core Command Injection vulnerability

A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...

9.8CVSS8AI score0.02862EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

pyLoad allows upload to arbitrary folder lead to RCE

SummaryAn authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution Detailsexample version: 0.5file:src/pyload/webui/app/blueprints/[email protected]"/render/", endpoint="render"def renderfilename: mimetype =...

9.1CVSS7.5AI score0.01354EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

Langflow Unauth RCE

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...

9.8CVSS7.7AI score0.99996EPSS
SaveExploits35References11Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

BentoML SSRF Vulnerability in File Upload Processing

DescriptionThere's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automaticall...

9.9CVSS7.4AI score0.11883EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the...

9.8CVSS7.5AI score0.01153EPSS
SaveExploits2References7Affected Software1
PyPA
PyPA
added 2026/06/29 11:50 a.m.15 views

OpenStack Object Storage (swift) Code Injection vulnerability

OpenStack Object Storage swift before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object...

9.8CVSS7.6AI score0.06518EPSS
SaveExploits0References19Affected Software1
PyPA
PyPA
added 2026/06/23 5:17 p.m.15 views

PYSEC-2026-244

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" or "Public Flows" in code contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of...

6.1CVSS6AI score0.00409EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2026/06/17 8:17 p.m.15 views

PYSEC-2026-2280

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an...

5.3CVSS6AI score0.00213EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/06/09 11:16 p.m.15 views

PYSEC-2026-210

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to...

7.5CVSS5.5AI score0.00263EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2026/06/09 4:43 p.m.15 views

PYSEC-2026-219

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

6.5CVSS6.4AI score0.01475EPSS
SaveExploits1References17Affected Software1
PyPA
PyPA
added 2026/06/03 2:16 p.m.15 views

PYSEC-2026-214

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines. An...

5.3CVSS5.4AI score0.00172EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/06/03 2:16 p.m.15 views

PYSEC-2026-213

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 unlimited, an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory...

7.5CVSS5.3AI score0.00328EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/06/01 9:16 a.m.15 views

PYSEC-2026-174

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...

3.1CVSS5.8AI score0.00358EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/06/01 8:16 a.m.15 views

PYSEC-0000-CVE-2026-45192

A bug in the GET /api/v2/connections/connectionid REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob under field names not present in the redaction allowlist DEFAULTSENSITIVEFIELDS —...

6.5CVSS5.8AI score0.00425EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/06/01 8:16 a.m.15 views

PYSEC-2026-173

A bug in the GET /api/v2/connections/connectionid REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob under field names not present in the redaction allowlist DEFAULTSENSITIVEFIELDS —...

6.5CVSS5.8AI score0.00425EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/05/27 6:16 p.m.15 views

PYSEC-2026-189

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

8.8CVSS5.9AI score0.00317EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2026/05/27 6:16 p.m.15 views

PYSEC-0000-CVE-2026-44346

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

8.8CVSS5.9AI score0.00321EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2026/05/01 9:16 a.m.15 views

PYSEC-2026-205

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent IPA sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image...

8CVSS6AI score0.00823EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/04/07 5:16 p.m.15 views

PYSEC-2026-124

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the safeextractall function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix for its path traversal check, which performs character-level string comparison rather than path-level...

8.1CVSS5.8AI score0.00327EPSS
SaveExploits2References1Affected Software1
PyPA
PyPA
added 2026/04/07 3:17 p.m.15 views

PYSEC-2026-51

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores.Earlier, unsupported Django...

7.5CVSS5.8AI score0.00436EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/04/07 3:17 p.m.15 views

PYSEC-2026-53

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.Admin changelist forms using ModelAdmin.listeditable incorrectly allowed newinstances to be created via forged POST data.Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...

2.7CVSS5.8AI score0.00294EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/04/07 6:16 a.m.15 views

PYSEC-2026-2288

A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The loadrngstate method in src/transformers/trainer.py at line 3059 calls torch.load without the weightsonly=True parameter. This issue affects all versions of the...

7.8CVSS6.9AI score0.00349EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/29 6:16 p.m.15 views

PYSEC-2026-204

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The respondrequest function in backend/routers/friends.py does not implement proper authorization checks, enabling Insecure Direct...

8.3CVSS7.3AI score0.00268EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/27 1:16 a.m.15 views

PYSEC-2026-157

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...

7.8CVSS6AI score0.00257EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
added 2026/03/22 1:16 a.m.15 views

PYSEC-2026-39

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash...

6.9CVSS6AI score0.00178EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/03/17 11:16 a.m.15 views

PYSEC-2026-15

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.Users are recommended to...

4.3CVSS5.8AI score0.0044EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/03/17 11:16 a.m.15 views

PYSEC-2026-17

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop HITL endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.Users are recommended to upgrade to...

8.1CVSS5.8AI score0.00409EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/03/09 4:16 p.m.15 views

PYSEC-2026-84

An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information...

6.5CVSS5.8AI score0.00167EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/02/26 2:16 a.m.15 views

PYSEC-2026-7

Agenta is an open-source LLMOps platform. A Server-Side Template Injection SSTI vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is executed server-side within the API process when runni...

8.8CVSS5.9AI score0.00318EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2026/02/26 2:16 a.m.15 views

PYSEC-2026-2246

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the pullrequesttarget event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context ...

9.9CVSS6.1AI score0.00395EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/02/13 12:16 p.m.15 views

PYSEC-2026-26

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version1.12.0.Users are recommended to upgrade to version 1.12.1 or...

7.3CVSS7.2AI score0.00602EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/02/03 3:16 p.m.15 views

PYSEC-2026-45

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.django.utils.text.Truncator.chars and Truncator.words methods with html=True and the truncatecharshtml and truncatewordshtml template filters allow a remote attacker to cause a potential denial-of-service via...

7.5CVSS7.1AI score0.00993EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/01/30 7:16 p.m.15 views

PYSEC-2026-62

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the topostgis function being used to write GeoDataFrames to a PostgreSQL database...

8.6CVSS5.8AI score0.00385EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/01/22 5:16 p.m.15 views

PYSEC-2026-107

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents...

7.5CVSS5.8AI score0.0055EPSS
SaveExploits1References3Affected Software1
Total number of security vulnerabilities5000