Lucene search
+L
PypaMost viewed

7586 matches found

PyPA
PyPA
added 2026/05/07 3:16 p.m.15 views

PYSEC-2026-2316

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cyclesessionkeys", but DRF API tokens "wlu" prefix stored in "authtokentoken" are not revoked. This issue has been patched in version 5.17.1...

5.4CVSS6AI score0.0027EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2026/05/04 6:16 p.m.15 views

PYSEC-2026-2242

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid...

8.1CVSS6AI score0.00305EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/04/15 7:16 p.m.15 views

PYSEC-2026-2314

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...

5CVSS6.1AI score0.00254EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/04/07 3:17 p.m.15 views

PYSEC-2026-2267

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMINONLYOPTIONS protection mechanism restricts security-critical configuration values reconnect scripts, SSL certs, proxy credentials to admin-only access. However, this protection is only...

8.8CVSS6.2AI score0.00815EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/04/02 3:16 p.m.15 views

PYSEC-2026-2174

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.getvalue and is implemented...

7.8CVSS6.2AI score0.00869EPSS
SaveExploits3References3Affected Software1
PyPA
PyPA
added 2026/04/02 3:16 p.m.15 views

PYSEC-2026-2173

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server activated with glances -s or glances --server sends Access-Control-Allow-Origin: on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an...

7.1CVSS6.1AI score0.00332EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/04/01 9:17 p.m.15 views

PYSEC-2026-2101

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4...

6.9CVSS6AI score0.00292EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/04/01 9:16 p.m.15 views

PYSEC-2026-2096

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the contenttype parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4...

6.9CVSS6AI score0.00315EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/04/01 9:16 p.m.15 views

PYSEC-2026-2097

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4...

8.7CVSS6.1AI score0.00433EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/04/01 9:16 p.m.15 views

PYSEC-2026-2094

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4...

7.5CVSS6AI score0.0044EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/04/01 7:16 p.m.15 views

PYSEC-2026-2131

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc and similar file-access primitives. Attackers can exploit th...

7.1CVSS6.2AI score0.00282EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/03/29 6:16 p.m.15 views

PYSEC-2026-2199

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the /api/files/export-content endpoint. The downloadimagetotemp function in backend/routers/files.py fails to validate user-controlled URLs, allowing attackers to make arbitrary HTT...

7.5CVSS7.2AI score0.01765EPSS
SaveExploits2References2Affected Software1
PyPA
PyPA
added 2026/03/29 6:16 p.m.15 views

PYSEC-2026-2198

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the Dependsgetcurrentactiveus...

9.8CVSS6.9AI score0.01936EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/03/25 7:16 p.m.15 views

PYSEC-2026-2223

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, execcmd in modoboa/lib/sysutils.py always runs subprocess calls with shell=True. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacte...

7.2CVSS6.2AI score0.00566EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/23 11:17 p.m.15 views

PYSEC-2026-2184

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaT...

8.8CVSS6.2AI score0.00782EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/03/20 11:16 p.m.15 views

PYSEC-2026-2235

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnetapp contains a reflected cross-site scripting issue in the lookup... route. A crafted...

6.1CVSS7.1AI score0.00331EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/20 2:16 a.m.15 views

PYSEC-2026-2291

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. The leaked memory is a copy of the string form of the integer plus a...

7.5CVSS6.9AI score0.00479EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/03/18 6:16 p.m.15 views

PYSEC-2026-2171

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent...

5.9CVSS6.2AI score0.00184EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/18 6:16 a.m.15 views

PYSEC-2026-2166

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with glances -w, exposing REST API with sensitive system information including process command-lines containing credentials passwords, API keys,...

8.7CVSS7AI score0.0155EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/18 12:16 a.m.15 views

PYSEC-2026-2269

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to setcookiegeneratecallback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0....

9.8CVSS6.4AI score0.00704EPSS
SaveExploits0References23Affected Software1
PyPA
PyPA
added 2026/03/16 6:16 p.m.15 views

PYSEC-2026-2116

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registe...

8.3CVSS6.6AI score0.00142EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/12 8:16 p.m.15 views

PYSEC-2026-2121

Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the...

8.7CVSS7.1AI score0.00621EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/03/06 7:16 a.m.15 views

PYSEC-2026-2128

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the includefilters field. These XPath expressions are processed using the elementpath library which...

9.3CVSS6.1AI score0.00484EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/03/05 8:16 p.m.15 views

PYSEC-2026-2202

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the tag passes through the default Cleaner configuration. While pagestructure=True removes html, head, and title tags, there is no specific handling for , allowing an attacker to inje...

6.1CVSS6.7AI score0.00254EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/03/05 8:16 p.m.15 views

PYSEC-2026-2308

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting XSS vulnerability exists on confirmation messages within the wagtail.contrib.simpletranslation module. A user with access to the Wagtail admin area...

6.1CVSS6.1AI score0.00459EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/02/27 8:21 p.m.15 views

PYSEC-2026-2258

pillowheif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds rea...

9.1CVSS6.2AI score0.00632EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/02/27 8:21 p.m.15 views

PYSEC-2026-2248

pillowheif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds rea...

9.1CVSS6.2AI score0.00632EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
added 2026/02/25 5:17 a.m.15 views

PYSEC-2026-2125

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the...

6.1CVSS6.1AI score0.00445EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/02/24 3:21 p.m.15 views

PYSEC-2026-2205

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the...

8.8CVSS6.2AI score0.11113EPSS
SaveExploits5References3Affected Software1
PyPA
PyPA
added 2026/02/21 10:16 a.m.15 views

PYSEC-2026-2271

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable e.g., --dashboard-host=0.0.0.0, a web page via DNS rebinding o...

6.5CVSS6.1AI score0.00265EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/02/19 4:27 p.m.15 views

PYSEC-2026-2182

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the...

5.4CVSS6AI score0.00167EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2026/01/27 10:15 p.m.15 views

PYSEC-2026-2286

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file .pth that, when loaded with torch.load..., weightsonly=True, can corrupt memory and potentially lead to...

8.8CVSS6.9AI score0.00721EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2025/06/13 2:15 p.m.15 views

PYSEC-2025-256

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

7.5CVSS6.2AI score0.00886EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2025/05/26 8:15 a.m.15 views

PYSEC-2025-46

A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and m...

5.5CVSS6.6AI score0.00236EPSS
SaveExploits1References18Affected Software1
PyPA
PyPA
added 2025/04/06 8:15 p.m.15 views

PYSEC-2025-16

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery SSRF vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request ...

9.3CVSS7.2AI score0.00636EPSS
SaveExploits2References2Affected Software1
PyPA
PyPA
added 2025/04/03 3:15 p.m.15 views

PYSEC-2025-264

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds rea...

4.8CVSS5.2AI score0.00278EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2025/04/03 2:15 p.m.15 views

PYSEC-2025-263

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buff...

7.8CVSS5.8AI score0.00328EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2025/03/31 9:15 p.m.15 views

PYSEC-2025-262

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument...

6.5CVSS5.6AI score0.00623EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
added 2025/03/10 2:15 p.m.15 views

PYSEC-2025-22

A vulnerability, that could result in Remote Code Execution RCE, has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code.Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting th...

9.8CVSS7.8AI score0.01048EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2025/03/06 5:15 a.m.15 views

PYSEC-2025-23

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

6.4CVSS7AI score0.00192EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2025/02/21 10:15 p.m.15 views

PYSEC-2025-31

vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the...

9.1CVSS6.8AI score0.0057EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2025/01/29 9:15 p.m.15 views

PYSEC-2025-26

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

7CVSS7.8AI score0.00306EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2025/01/29 9:15 p.m.15 views

PYSEC-2025-28

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential...

5.5CVSS7AI score0.0014EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2025/01/23 1:15 a.m.15 views

PYSEC-2025-133

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component grayrecordcell...

6.5CVSS5.7AI score0.00349EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2025/01/23 1:15 a.m.15 views

PYSEC-2025-132

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component compositionsourceover...

6.5CVSS5.7AI score0.00349EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2024/12/10 7:19 p.m.15 views

A number of releases of ultralytics contained malicious crypto miner software.

Ultralytics has identified a supply chain attackaffecting affecting multiple versions of the ultralytics package.The compromised versions contained unauthorized code thatdownloaded and executed cryptocurrency mining softwarewhen instantiating YOLO models.This code was injected into the PyPI relea...

8.7CVSS7.2AI score
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2024/12/06 12:15 p.m.15 views

PYSEC-2024-157

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

9.8CVSS8AI score0.01415EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
added 2024/11/25 2:15 p.m.15 views

PYSEC-2024-224

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

7CVSS6.9AI score0.00121EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2024/11/22 10:15 p.m.15 views

PYSEC-2024-228

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

8.8CVSS7.7AI score0.03074EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2024/11/22 10:15 p.m.15 views

PYSEC-2024-229

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

8.8CVSS7.7AI score0.02566EPSS
SaveExploits1References2Affected Software1
Total number of security vulnerabilities5000