NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains

GHSA-89p3-fcch-88ph CVE-2026-126299 HIGH 1 day ago

## Summary The public CCG lexicon parser `nltk.ccg.lexicon.fromstring` parses caller-influenced lexicon text with two pure-Python loops whose cost...

pypi

No PRs yet

NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)

GHSA-r53h-rw34-8h97 CVE-2026-126298 HIGH 1 day ago

## Summary `Tree.chomsky_normal_form()` binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch...

pypi

No PRs yet

NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan

GHSA-v8f3-6phw-6mh9 CVE-2026-126297 HIGH 1 day ago

## Summary `ConllCorpusReader.srl_instances()` builds semantic-role-labeling instances from a CoNLL corpus block. For a sentence block with P pred...

pypi

No PRs yet

NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

GHSA-fg9w-wfp5-j933 CVE-2026-126295 MODERATE 1 day ago

## Summary `BllipParser` in `nltk/parse/bllip.py` hands caller-supplied filesystem paths to the native `bllipparser` C extension without routing t...

pypi

No PRs yet

NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop

GHSA-gpwc-27cw-rh9r MODERATE 1 day ago

## Summary `LegalitySyllableTokenizer.tokenize` in the NLTK tokenizer package contains an unguarded O(n^2) processing loop. When the method is cal...

pypi

No PRs yet

NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop

GHSA-ffr9-mgrr-wcvr CVE-2026-126300 MODERATE 1 day ago

## Summary `TreebankWordTokenizer.span_tokenize` in the NLTK tokenizer package contains an unguarded O(n^2) processing loop in its quote-restorati...

pypi

No PRs yet

NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars

GHSA-8fx7-8jr8-84rv CVE-2026-126303 HIGH 1 day ago

## Summary `nltk.parse.recursivedescent.SteppingRecursiveDescentParser.parse()` performs an unbounded top-down search over ambiguous or self-embed...

pypi

No PRs yet

NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox

GHSA-qg35-44qx-7vrr CVE-2026-126304 HIGH 1 day ago

## Summary `YCOECorpusReader` builds two nested corpus sub-readers whose roots are derived from `self.root.join("psd")` and `self.root.join("pos")...

pypi

No PRs yet

Tornado: Open redirect via triple-slash redirect paths

GHSA-5cjw-f85j-cv6r CVE-2026-126347 LOW 1 day ago

### Summary Due to differences in the way browsers and Python's `urllib` parse urls, browsers treat a string starting with three or more slashes a...

pypi

No PRs yet

dnspython has excessive memory and CPU use

GHSA-vvf4-9x63-8xvv CVE-2026-128089 HIGH 1 day ago

### Summary A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due t...

pypi

No PRs yet

envd: Host file disclosure through requirements path traversal and TOCTOU

GHSA-jv6m-48w5-5rpr CVE-2026-128079 MODERATE 1 day ago

### Summary envd’s `install.python_packages(requirements=...)` could read files outside the build context on the host. Content interpreted as depe...

pypi

No PRs yet

OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing

GHSA-mf5v-w3w3-f6cg CVE-2026-126360 MODERATE 1 day ago

## Summary `TraceContextTextMapPropagator.extract()` in `opentelemetry-api` is vulnerable to regular expression denial of service (ReDoS) when pro...

pypi

No PRs yet

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

GHSA-6655-6qjp-jx7x CVE-2026-126191 HIGH 1 day ago

### Summary The IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (`\9`) i...

pypi

No PRs yet

Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack

GHSA-7g44-g9rc-x53w CVE-2026-126193 MODERATE 1 day ago

## Summary The Soup Sieve CSS selector parser recurses once per level of nested pseudo-class selector (`:is()`, `:not()`, `:where()`, `:has()`) wi...

pypi

No PRs yet

Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

GHSA-x585-4vv8-2mh2 CVE-2026-100397 CRITICAL 2 days ago

## Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH cha...

pypi

No PRs yet

Soup Sieve: Polynomial-time denial of service in the descendant combinator

GHSA-mmhr-3c5m-f64f CVE-2026-126190 HIGH 2 days ago

## Summary Matching a selector that uses the descendant combinator (`a b`) takes time that grows polynomially with how deeply the document is nest...

pypi

No PRs yet

Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time

GHSA-4j63-6c4x-wfg4 CVE-2026-126192 MODERATE 2 days ago

## Summary Matching a selector that puts a general-sibling combinator inside `:has()`, such as `div:has(a ~ b)`, against untrusted HTML runs in O(...

pypi

No PRs yet

Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data

GHSA-wqgw-9xfh-qf2g CVE-2026-128066 MODERATE 2 days ago

``` ============================================================================ ANT-2026-D7STJUWL [medium] CWE-770 dos Memory DoS in TIFF and E...

pypi

No PRs yet

Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

GHSA-xcvg-w56q-r89m CVE-2026-128067 HIGH 2 days ago

``` ============================================================================ ANT-2026-CS7N494P [high] CWE-787 memory-safety Heap buffer over...

pypi

No PRs yet

compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages 

GHSA-8v59-qmwv-4p6q CVE-2026-125123 LOW 4 days ago

### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The ...

pypi

No PRs yet

compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout

GHSA-hr4h-4c45-v4q4 CVE-2026-125122 LOW 4 days ago

### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. `--f...

pypi

No PRs yet

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

GHSA-r7j4-crjv-h467 CVE-2026-125121 MODERATE 4 days ago

### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The ...

pypi

No PRs yet

OctoPrint: Stored XSS via saved connection parameters

GHSA-p623-mxf7-qxjm CVE-2026-123364 LOW 4 days ago

## Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default `port` or ...

pypi

No PRs yet

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

GHSA-rm8w-w798-g545 CVE-2026-123796 LOW 4 days ago

### Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the `${NAME}` a sibling `.env` filled in, instead of its ...

actions pypi

No PRs yet

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

GHSA-3hch-x692-6qj3 CVE-2026-103002 HIGH 4 days ago

### Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kuberne...

pypi

No PRs yet

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

GHSA-2h4w-29cv-2cmv CVE-2026-113663 HIGH 4 days ago

### Summary SandboxShellTool's restricted modes — allowed=[...] (explicit command allowlist) and readonly=True (implicit READONLY_COMMANDS allowlis...

pypi

No PRs yet

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

GHSA-62m9-f875-rqw6 CVE-2026-102894 CRITICAL 4 days ago

### Impact The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session ...

pypi

No PRs yet

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

GHSA-whr6-fgpq-fpv9 CVE-2026-123373 LOW 4 days ago

### Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could the...

actions pypi

No PRs yet

compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

GHSA-88f4-frh5-gmcr CVE-2026-123371 LOW 4 days ago

### Impact compose-lint automatically reads a `.compose-lint.yml` policy file beside the Compose file. It is meant to read nothing outside the pro...

actions pypi

No PRs yet

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

GHSA-jf3h-8jvx-vcrg CVE-2026-123372 LOW 4 days ago

### Impact Since 0.22.0, compose-lint fills in `${VAR}` references from the `.env` beside the Compose file, as Compose does. The documentation say...

actions pypi

No PRs yet

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

GHSA-65v8-q222-64xx CVE-2026-123370 MODERATE 4 days ago

### Impact `compose-lint fix --apply` converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone car...

pypi

No PRs yet

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

GHSA-6f4g-xm8v-pgv6 CVE-2026-123369 MODERATE 4 days ago

### Impact The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere in...

actions pypi

No PRs yet

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

GHSA-6wcv-rj3c-mhv3 CVE-2026-123368 LOW 4 days ago

### Impact compose-lint fills in `${VAR}` references from the `.env` file next to the Compose file. It is meant to read nothing outside the projec...

actions pypi

No PRs yet

Kiwi TCMS account confirmation open redirect through protocol-relative URLs

GHSA-gcwf-c25f-p9rv CVE-2026-77433 MODERATE 5 days ago

## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endp...

pypi

No PRs yet

Code Graph RAG structural tools follow out-of-root symlinks

GHSA-85gg-2gfq-q95m CVE-2026-87008 HIGH 5 days ago

A remote/local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can cause the `structural_sea...

pypi

No PRs yet

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

GHSA-gj9m-f8ph-pmhr CVE-2026-102895 CRITICAL 5 days ago

### Impact In GPUStack before v2.2.0, `get_current_user` (in `gpustack/api/auth.py`) promotes any request whose source is considered loopback to t...

pypi

No PRs yet

Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

GHSA-cp25-j9x5-p5xm CVE-2026-103022 MODERATE 5 days ago

### Summary The `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request...

pypi

No PRs yet

fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution

GHSA-9vhv-g5hf-m7m7 CVE-2026-102610 MODERATE 5 days ago

## Summary `fast-agent serve` exposes the agent over MCP. By default it uses HTTP transport bound to `0.0.0.0` (all interfaces) on port 8000 with *...

pypi

No PRs yet

zizmor: Debug logging prints available GitHub credentials in cleartext

GHSA-f42p-wjw5-97qh CVE-2026-102289 HIGH 5 days ago

### Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables...

pypi

No PRs yet

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

GHSA-vvr2-h2jp-838m CVE-2026-77604 HIGH 5 days ago

### Summary The `read_file` MCP tool in `codebase_rag/mcp/tools.py` contains a path traversal vulnerability in its paginated branch (when `offset`...

pypi

No PRs yet

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

GHSA-p2mm-64f6-gmpp CVE-2026-63471 CRITICAL 5 days ago

### Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal ...

pypi

No PRs yet

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

GHSA-6xmv-cjr5-w3q8 CVE-2026-63469 CRITICAL 5 days ago

### Summary fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each res...

pypi

No PRs yet

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

GHSA-h667-4jj2-cgv4 CVE-2026-63470 CRITICAL 5 days ago

### Summary fastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted str...

pypi

No PRs yet

Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

GHSA-w7qv-268h-9h3f CVE-2026-63417 HIGH 5 days ago

Impact PII data in str/repr of non primitive objects was not being redacted, leading to leakage of PII in logs that should have been redacted for c...

pypi

No PRs yet

GeoNode has Stored XSS in Documents metadata abstract field

GHSA-r4hm-p9f9-fj9v CVE-2026-55649 MODERATE 8 days ago

The abstract metadata of documents is not sanitised. It’s possible to store arbitrary HTML (and JS) that will be executed when visiting the page.

pypi

No PRs yet

GeoNode has Unrestricted File Upload

GHSA-fqpv-mq26-pr4j CVE-2026-46429 MODERATE 8 days ago

The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files.

pypi

No PRs yet

GeoNode has OS command injection via uploaded file layer name

GHSA-9fpx-fr6j-2vh6 CVE-2026-33050 HIGH 8 days ago

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.

pypi

No PRs yet

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

GHSA-64vx-6h2c-rjh7 CVE-2026-61536 HIGH 9 days ago

## Summary `banks` parses `Tool` JSON objects from the rendered body of `{% completion %}` blocks and later resolves their `import_path` field...

pypi

No PRs yet

Stanza: RCE via pickle deserialization in the lemmatizer

GHSA-gh9r-c94j-cmp5 CVE-2026-115878 HIGH 11 days ago

## TL;DR Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip...

pypi

No PRs yet

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

GHSA-5849-834g-hvw5 CVE-2026-119203 HIGH 15 days ago

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file witho...

pypi

No PRs yet