Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2026/03/27 1:16 a.m.21 views

PYSEC-2026-106

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...

9.9CVSS6.1AI score0.01892EPSS
SaveExploits2References5Affected Software1
PyPA
PyPA
added 2026/03/12 5:16 p.m.21 views

PYSEC-2026-118

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration allowAbsoluteUrls: true...

7.7CVSS5.9AI score0.00212EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2026/01/28 9:9 p.m.21 views

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...

5.8AI score
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2026/01/21 6:16 p.m.21 views

PYSEC-2026-101

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder...

7.5CVSS5.8AI score0.04549EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
added 2026/01/05 6:15 p.m.21 views

PYSEC-2026-116

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation...

9.1CVSS5.8AI score0.00207EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
added 2025/04/22 6:15 p.m.21 views

PYSEC-2025-56

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential...

4.3CVSS7AI score0.00236EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
added 2025/04/02 10:15 p.m.21 views

PYSEC-2025-196

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jitmodulefromflatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used...

5.5CVSS4.8AI score0.00262EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2025/03/20 10:15 a.m.21 views

PYSEC-2025-9

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

9.8CVSS8.2AI score0.05342EPSS
SaveExploits5References3Affected Software1
PyPA
PyPA
added 2021/07/06 12:15 p.m.21 views

PYSEC-2021-112

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry ACE to an access control list ACL that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process...

6.5CVSS7AI score0.01729EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

ImpactLiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...

6.5CVSS6.1AI score0.00313EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

SummaryPillow's TGA RLE encoder reads past its row buffer when saving a mode "1"image. Adjacent process heap bytes can be copied into the generated TGA file.The bug is reachable through the public save API:pythonim.saveout, format="TGA", compression="tgarle"Older affected Pillow versions use the...

7.5CVSS6.4AI score0.00313EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.20 views

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

SummaryWhen Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride i...

8.3CVSS8.3AI score0.00476EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

SummaryIn affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

8.1CVSS5.4AI score0.00149EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

Anki's local HTTP server does not sufficiently validate requests

SummaryAnki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impactThe severity varies by...

8.7CVSS5.3AI score0.00179EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

SummaryThe multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments via crafted prompts, user inp...

9.1CVSS5.8AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature onlywhen a secret is configured. When the secret environment variable is unset — thedefault on a fresh install and common in development — verification is skipped entirelyand the webhook body is parsed and dispatched a...

8.6CVSS5.4AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

SummaryA workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check...

8.1CVSS5.3AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAIWeakness: CWE-918 Server-Side Request Forgery SSRF.--- SummaryThe SSRF guard...

8.5CVSS5.3AI score0.00165EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.21 views

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding SummaryPraisonAI's Async Jobs API validates webhookurl when a job request is parsedand again when the internal Job object is constructed. That validation blocksdirect loopback/private targets, but it is not bound to the later networkrequest...

7.2CVSS5.6AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.20 views

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal SummaryPraisonAI's Dynamic Context module provides filesystem-backed history andterminal-log storage. The SDK reference describes the module as providing:- artifact storage for tool...

7.5CVSS5.2AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.20 views

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing SummaryPraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treatsLINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logsa warning and handlewebhook skips Linear-Signature...

8.6CVSS6.3AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.20 views

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard SummaryPraisonAI's installed console entrypoint is Typer-first. In current releases,the recipe command is registered in the Typer app andpraisonai recipe serve dispatches to the deprecated Typer command...

8.2CVSS6.5AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/23 11:41 a.m.20 views

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials...

9.9CVSS5.5AI score0.00733EPSS
SaveExploits0References11Affected Software1
PyPA
PyPA
added 2026/07/14 4:17 p.m.20 views

PYSEC-2026-3452

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open to seek backwards to the same directive and parse it repeatedly in an infinite...

7.5CVSS6.1AI score0.00399EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:hrefReporter: Guillem Lefait · Date: 2026-05-10Affected: lxml ≤ 6.1.0 and lxmlhtmlclean ≤ 0.4.4 latest stableConfirmed against: lxml 6.1.0 + lxmlhtmlclean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 libxml...

8.2CVSS6.2AI score
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI allows limited stored XSS vila uploaded html file

SummaryLow privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

6.4CVSS6.1AI score0.00342EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

SQLChatAgent validatequery dangerous-pattern regex is bypassable via quoted/commented/qualified function names SummaryThe SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only stateme...

9.3CVSS6.2AI score0.00558EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)

SummaryA memory-safety vulnerability in Open Babel's MOPAC output parserallowed an out-of-bounds write into the translationVectors arraywhen reading the "UNIT CELL TRANSLATION" block of a crafted inputfile. DetailsThe MOPAC output reader stored translation vectors from the UNIT CELLTRANSLATION...

9.8CVSS6.7AI score0.00804EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant)

SummaryA memory-safety vulnerability in Open Babel's ORCA parser allowed anout-of-bounds write when reading a crafted input file. DetailsA second variant of the nAtoms out-of-bounds write in the ORCAreader: a different malformed-input path produced the same class ofwrite past the end of the...

9.8CVSS6.7AI score0.00804EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

SummaryOpen WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin searchknowledgefiles tool.When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call searchknowledgefiles with an arbitrary knowledgeid...

4.3CVSS6.1AI score0.00259EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.20 views

Open WebUI: Forged chat-file link allows cross-user file read and deletion

SummaryOpen WebUI v0.9.5 lets an authenticated user attach arbitrary fileid values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, hasaccesstofile treats the victim file as accessible...

8.3CVSS6.2AI score0.00292EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

SummaryType: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on requireworkspacememberworkspaceid only, then resolve projectid through ProjectService.getprojectid / updateprojectid...

8.1CVSS6.1AI score0.00289EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

SummaryType: Authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any member can rewrite the workspace's name, description, and the settings JSON blob. The...

6.5CVSS6.2AI score0.00195EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.20 views

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

SummaryThe fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py: "registers four file-handling tools by default, praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and...

9.6CVSS6.1AI score0.0062EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module.Finding 1 Critical: SSRF CWE-918The HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to...

6.7CVSS6.2AI score0.00012EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Summary Flask-Security-Too 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth...

6AI score0.00279EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

Crawlee for Python: SSRF via sitemap-derived URLs

Overview- Vulnerability type: Blind SSRF- Affected components: src/crawlee/utils/sitemap.py, src/crawlee/utils/robots.py, src/crawlee/requestloaders/sitemaprequestloader.py, and all built-in HTTP clients.- Trigger: an attacker-controlled sitemap or robots.txt containing a URL that points to an...

2.3CVSS6.5AI score0.00286EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

SummaryThe SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parseurls API. An authenticated attacker can supply a URL pointing to an...

5CVSS6.2AI score0.00176EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

SummaryA path traversal vulnerability exists in Pipecat's development runner src/pipecat/runner/run.py. When the runner is started with the --folder flag, it exposes a GET /files/filename:path download endpoint. The filename path parameter is concatenated directly onto args.folder with no...

7.5CVSS7AI score0.00423EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.20 views

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summaryfides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridd...

7CVSS6.3AI score0.00297EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.20 views

Open WebUI's Insecure Message Access Breaks Authorization

DescriptionThere's an IDOR in the channels message management system that allows authenticated users to modify or delete any message within channels they have read access to. The vulnerability exists in the message update and delete endpoints, which implement channel-level authorization but...

7.1CVSS6.2AI score0.00266EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.20 views

OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...

7.4CVSS6.2AI score0.00206EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.20 views

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

SummaryThe attributefilter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to...

10CVSS6.5AI score0.00613EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.20 views

parisneo/lollms has an insufficient session expiration vulnerability

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject reques...

4.1CVSS6.1AI score0.0021EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.20 views

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Vulnerability IDOR in GET/PATCH/DELETE /api/v1/flow/flowidThe readflow helper in src/backend/base/langflow/api/v1/flows.py branched on the AUTOLOGIN setting to decide whether to filter by userid. When AUTOLOGIN was False i.e., authentication was enabled, neither branch enforced an ownership check...

8.8CVSS6.1AI score0.00468EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.20 views

FPE in `tf.image.generate_bounding_box_proposals`

ImpactWhen running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked.pythonimport tensorflow as tfa = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0b =...

7.5CVSS6.9AI score0.00439EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/08 2:16 p.m.20 views

PYSEC-2026-2089

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function asyncruncommand of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement...

7.8CVSS5.8AI score0.01545EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/07 4:42 p.m.20 views

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

8.4CVSS6.6AI score0.00143EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/07 4:36 p.m.20 views

pip Path Traversal vulnerability

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations...

2CVSS5.9AI score0.0039EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/07 4:3 p.m.20 views

GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter reflected DOM XSS...

6.1CVSS6.1AI score0.00337EPSS
SaveExploits0References8Affected Software1
Total number of security vulnerabilities5000