aiohttp server lacks an initial request/header timeout

GHSA-5wr8-gcqf-gqf3 CVE-2026-111064 HIGH about 12 hours ago

### Summary The keepalive timeout was not used during the initial portion of a request. ### Impact An attacker could keep an idle connection ope...

pypi

No PRs yet

AIOHTTP: Secure attribute not enforced for shared cookie

GHSA-494j-54xm-rwp3 CVE-2026-111063 LOW about 12 hours ago

### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send a shared cookie marked Secu...

pypi

No PRs yet

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

GHSA-2g87-pp6c-29x5 HIGH about 12 hours ago

### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled r...

pypi

No PRs yet

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

GHSA-2658-85cv-9wwq CVE-2026-111059 MODERATE about 12 hours ago

## Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The `mr.Markdown` widget converts its input to HTML with **python-mark...

pypi

No PRs yet

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

GHSA-f8c7-rwf9-fmgm CVE-2026-111057 CRITICAL about 12 hours ago

### Summary A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `/api/terminals` ...

pypi

No PRs yet

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

GHSA-pcc4-rvhr-2pr8 MODERATE about 12 hours ago

## Summary The Fortran extractor's C-preprocessor step (`graphify/extractors/fortran.py`, `_cpp_preprocess`) applies an incomplete `#include` hard...

pypi

No PRs yet

Mercury: Unauthenticated Remote Code Execution via /api/kernels

GHSA-rv4m-xm3f-3ccq CVE-2026-111058 CRITICAL about 12 hours ago

Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvider.token=''` when no `--toke...

pypi

No PRs yet

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

GHSA-vx2m-gpq4-8j5q CVE-2026-108372 HIGH about 13 hours ago

## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthenticated `GET` routes. Because ...

pypi

No PRs yet

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

GHSA-w5f2-9q9c-ff4h CVE-2026-105192 CRITICAL 3 days ago

### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport ### Det...

pypi

No PRs yet

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

GHSA-h4mw-j7qp-8mwm CVE-2026-96620 CRITICAL 3 days ago

The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginning with `-` to be interpre...

pypi

No PRs yet

ClickMigrate has Path Traversal in "revision -m" argument

GHSA-vgf9-9mxx-hq54 CVE-2026-68549 LOW 3 days ago

### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-m` argument to escape the i...

pypi

No PRs yet

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

GHSA-hqm2-cfx2-2vgh CVE-2026-102682 MODERATE 4 days ago

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development ...

pypi

No PRs yet

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

GHSA-jwrc-gm9j-263p CVE-2026-102832 MODERATE 4 days ago

## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a butto...

pypi

2

Dependabot PRs

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

GHSA-24cc-9352-h2pg CVE-2026-104266 MODERATE 4 days ago

### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-...

pypi

No PRs yet

copyparty FTP: upload outside defined volumes (limited path traversal)

GHSA-phv8-wgjp-g4p9 CVE-2026-104102 MODERATE 4 days ago

The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server...

pypi

No PRs yet

unstructured: Stored XSS via unescaped HTML generation

GHSA-v5mq-3xhg-98m9 CVE-2026-104250 MODERATE 4 days ago

### Summary When `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. `<im...

pypi

No PRs yet

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

GHSA-84m7-p3x7-pcfv CVE-2026-59951 MODERATE 4 days ago

### Summary In affected versions, a Streamable HTTP server in stateful mode (the default) never reclaimed session state: - sessions did not expire...

pypi

No PRs yet

borg extract might modify out-of-tree files when extracting maliciously crafted archives

GHSA-gfp8-w835-v44j CVE-2026-62268 MODERATE 4 days ago

### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item ...

pypi

No PRs yet

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

GHSA-526j-582w-7fm9 CVE-2026-62322 MODERATE 4 days ago

### Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorizat...

pypi

No PRs yet

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

GHSA-xpf3-p7gm-7756 CVE-2026-14966 LOW 5 days ago

BBOT's `unarchive` module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks w...

pypi

No PRs yet

Apprise forwards configured auth headers across cross-origin HTTP redirects

GHSA-856c-92hv-3vxx CVE-2026-59180 LOW 5 days ago

# Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders (`apprise/attachment/http.py`, `apprise/config/http.p...

pypi

No PRs yet

Shiny for Python has path traversal in bookmark restore

GHSA-47c3-hpmg-7j6p CVE-2026-108258 MODERATE 10 days ago

### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and joined it into the server-side ...

pypi

No PRs yet

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

GHSA-3hj7-6vmj-h8v4 CVE-2026-107841 MODERATE 10 days ago

### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-bound** marker before a cre...

pypi

No PRs yet

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

GHSA-68w4-83fh-f2w8 HIGH 11 days ago

## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachable at `/api/getUserData` an...

pypi

No PRs yet

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

GHSA-9q47-3cm2-2rp8 MODERATE 11 days ago

## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplie...

pypi

No PRs yet

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

GHSA-jq7h-wrvp-3rgx HIGH 11 days ago

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never...

pypi

No PRs yet

pyLoad: Api.set_user_permission never invalidates the target's session

GHSA-889w-m37p-88m5 HIGH 11 days ago

### Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented `/api/<func>` RPC surface — e.g. `POS...

pypi

No PRs yet

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

GHSA-p3pr-8f3m-4qp8 MODERATE 11 days ago

## Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `p...

pypi

No PRs yet

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

GHSA-fr26-jjhm-638c HIGH 11 days ago

### Summary `UnTar._safe_extractall` — the hardening added for GHSA-mvwx-582f-56r7 — validates member **names** and symlink/hardlink **targets**, ...

pypi

No PRs yet

pyLoad has an authentication bypass in API key validation (check_apikey cache)

GHSA-r44w-v6gf-x3p6 HIGH 11 days ago

## Summary The API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long as the legitimate key for th...

pypi

No PRs yet

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

GHSA-j92p-c242-7hfx CVE-2026-75597 MODERATE 11 days ago

### Summary The `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentica...

pypi

No PRs yet

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

GHSA-vq8p-m3wm-gv5f CVE-2026-48484 MODERATE 11 days ago

## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded fil...

pypi

No PRs yet

Strawberry legacy graphql-ws retains naturally completed subscription slots

GHSA-m952-2w3f-6r8h CVE-2026-107727 LOW 11 days ago

### Summary Strawberry's legacy `graphql-ws` subscription handler can retain task and subscription bookkeeping after a one-shot subscription has n...

pypi

No PRs yet

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

GHSA-pfvf-fwfp-25mp CVE-2026-107728 HIGH 11 days ago

### Summary `PermissionExtension.resolve()` evaluates the return value of `has_permission()` for truthiness on the synchronous path. `supports_syn...

pypi

No PRs yet

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

GHSA-556j-vv39-8rqv CVE-2026-107716 MODERATE 11 days ago

### Summary In `banks.registries.DirectoryPromptRegistry`, prompt file paths and the index file (`index.json`) do not refuse symbolic links. When a...

pypi

No PRs yet

Banks: User-controlled prompt input can be parsed as privileged chat messages

GHSA-hmq2-7hp6-7crh CVE-2026-107717 MODERATE 11 days ago

## Summary Banks' `Prompt.chat_messages()` method parses every rendered output line as a potential `ChatMessage` JSON object. If attacker-cont...

pypi

No PRs yet

Indico: Incomplete Server-Side Request Forgery (SSRF) check

GHSA-2v95-h47v-g4x9 CVE-2026-107394 MODERATE 11 days ago

### Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, b...

pypi

No PRs yet

Indico: Missing access check in legacy session export API

GHSA-6p4f-j8j6-463q CVE-2026-107395 MODERATE 11 days ago

### Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricte...

pypi

No PRs yet

Indico: Cross-Site-Scripting in minutes editor

GHSA-cw24-x4mj-fw3q CVE-2026-107397 MODERATE 11 days ago

### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same mi...

pypi

No PRs yet

Indico: Cross-Site-Scripting in link fields

GHSA-c4wc-ggrj-jg9v CVE-2026-107396 MODERATE 11 days ago

### Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. ### Patches You should to update to [Indico 3....

pypi

No PRs yet

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

GHSA-c78w-2q4r-68r7 CVE-2026-61442 HIGH 11 days ago

# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary `praisonai-platform` lets an ...

pypi

No PRs yet

PraisonAI: Shell command allowlist bypass via find -exec built-in action

GHSA-cv3g-hj65-pcfh CVE-2026-61434 HIGH 11 days ago

### Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shel...

pypi

No PRs yet

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

GHSA-9mp3-24cc-77mg CVE-2026-61445 CRITICAL 11 days ago

### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path validation and no command saniti...

pypi

No PRs yet

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

GHSA-hc5v-gxvj-58wh CVE-2026-61427 HIGH 11 days ago

## Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults `--api-key` to `None`, s...

pypi

No PRs yet

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

GHSA-xxgv-vgvj-qvxh CVE-2026-61440 MODERATE 11 days ago

# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `praisonai-platform` lets an ord...

pypi

No PRs yet

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

GHSA-5r6c-gj4g-r697 CVE-2026-60085 HIGH 11 days ago

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_path...

pypi

No PRs yet

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

GHSA-4w49-gwv8-fpjg CVE-2026-60091 HIGH 11 days ago

## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint i...

pypi

No PRs yet

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

GHSA-6fqq-452j-qhrp CVE-2026-107286 HIGH 11 days ago

> This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. ### Summary Applications that wrap a model with `ConcurrencyLimite...

pypi

2

Dependabot PRs

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

GHSA-c3jg-qh8m-j3h2 CVE-2026-107378 HIGH 11 days ago

## Summary Rendering an untrusted SVG whose `<path d="...">` contains many segments is O(n²) CPU. A single `<path>` under 1 MiB burns tens of seco...

pypi

No PRs yet

PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

GHSA-4r3p-w3mc-5v34 CVE-2026-60086 MODERATE 11 days ago

## Summary PraisonAI's opt-in prompt-injection defense (`enable_injection_defense()`) only blocks at `ThreatLevel.CRITICAL`, which requires three ...

pypi

No PRs yet