Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
| ID | Severity | Description | Package | Published | Updated |
|---|---|---|---|---|---|
| pysec-2025-19 |
9.8 (3.1)
|
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for … | picklescan | 2025-03-03T19:15:34+00:00 | 2027-07-09T15:54:00+00:00 |
| pysec-2024-115 |
9.8 (3.1)
|
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community versi… | langchain-community | 2024-11-05T16:04:14Z | 2027-07-09T15:45:00Z |
| pysec-2026-2946 |
5.5 (3.1)
|
## Summary The approval system in PraisonAI Agents caches tool approval decisions by too… | praisonaiagents | 2026-07-13T14:36:52.273166Z | 2026-10-16T11:09:02.155931Z |
| pysec-2026-4318 |
6.5 (3.1)
|
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writ… | nltk | 2026-08-03T08:17:17.880Z | 2026-10-16T10:26:40.009564Z |
| pysec-2026-4317 |
5.4 (3.1)
|
### Summary The `trainer_login` view in wger accepts GET requests and executes `django_l… | wger | 2026-10-15T10:22:46.915403Z | 2026-10-15T14:38:15.492990Z |
| pysec-2026-4316 |
7.1 (3.1)
|
### Summary A user with only the `gym_trainer` permission can deactivate any account in … | wger | 2026-10-15T10:22:47.076447Z | 2026-10-15T14:38:15.403167Z |
| pysec-2026-4315 |
4.8 (3.1)
|
### Summary A vulnerability exists in the authentication/session lifecycle of `wger` whe… | wger | 2026-10-15T10:22:47.005398Z | 2026-10-15T14:38:15.217377Z |
| pysec-2026-4314 |
6.5 (3.1)
|
### Summary An authenticated attacker can inject arbitrary workout log entries into any … | wger | 2026-10-15T10:22:47.153748Z | 2026-10-15T14:38:15.145317Z |
| pysec-2026-4313 |
7.1 (3.1)
|
### Summary Five gym management views in wger apply a flawed gym-scope guard (`gym_a != … | wger | 2026-10-15T10:22:46.832742Z | 2026-10-15T14:38:15.073818Z |
| pysec-2026-4312 |
6.3 (4.0)
|
Werkzeug's `safe_join` function allows Windows device names as filenames when they have a… | werkzeug | 2026-10-15T10:22:46.332690Z | 2026-10-15T14:38:14.997317Z |
| pysec-2026-4311 |
8.8 (3.1)
|
### Summary This was found during a pentest, funded by the NLNnet foundation, conducted … | weasyprint | 2026-10-15T10:22:48.141884Z | 2026-10-15T14:38:14.896016Z |
| pysec-2026-4310 |
5.3 (3.1)
|
### Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-se… | vllm | 2026-10-15T10:22:45.585356Z | 2026-10-15T14:38:13.284710Z |
| pysec-2026-4309 |
6.5 (3.1)
|
## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25… | vllm | 2026-10-15T10:22:45.443277Z | 2026-10-15T14:38:13.200800Z |
| pysec-2026-4308 |
3.1 (3.1)
|
## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25… | vllm | 2026-10-15T10:22:46.407337Z | 2026-10-15T14:38:13.062873Z |
| pysec-2026-4307 |
5.3 (3.1)
|
## Summary The OpenAI-compatible chat endpoint accepts request-level video loader option… | vllm | 2026-10-15T10:22:45.518163Z | 2026-10-15T14:38:12.969063Z |
| pysec-2026-4306 |
6.5 (3.1)
|
## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25… | vllm | 2026-10-15T10:22:45.361001Z | 2026-10-15T14:38:12.869229Z |
| pysec-2026-4305 |
5.9 (4.0)
|
### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into… | uv | 2026-10-15T10:22:45.276429Z | 2026-10-15T14:38:12.433345Z |
| pysec-2026-4304 |
4.3 (3.1)
|
### Summary `wildcardToRegexp()` in `twisted/mail/imap4.py` converts IMAP LIST/LSUB wildc… | twisted | 2026-10-15T10:22:47.969401Z | 2026-10-15T14:38:12.013401Z |
| pysec-2026-4303 |
7.5 (3.1)
|
### Summary `PermissionExtension.resolve()` evaluates the return value of `has_permissio… | strawberry-graphql | 2026-10-15T10:22:54.407003Z | 2026-10-15T14:38:11.496782Z |
| pysec-2026-4302 |
3.7 (3.1)
|
### Summary Strawberry's legacy `graphql-ws` subscription handler can retain task and su… | strawberry-graphql | 2026-10-15T10:22:54.542860Z | 2026-10-15T14:38:11.354210Z |
| pysec-2026-4301 |
6.5 (3.1)
|
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node… | snowflake-connector-python | 2026-10-15T10:22:44.618980Z | 2026-10-15T14:38:10.612451Z |
| pysec-2026-4300 |
6.9 (4.0)
|
### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_i… | shiny | 2026-10-15T10:22:55.128915Z | 2026-10-15T14:38:10.488016Z |
| pysec-2026-4299 |
7.5 (3.1)
|
### Impact Since version 1.4.0, Scrapy respects the `Referrer-Policy` response header to… | scrapy | 2026-10-15T10:22:42.910431Z | 2026-10-15T14:38:10.288756Z |
| pysec-2026-4298 |
9.1 (3.1)
9.3 (4.0)
|
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initializati… | python-jose | 2026-10-15T10:22:43.820157Z | 2026-10-15T14:38:09.639843Z |
| pysec-2026-4297 |
6.5 (3.1)
8.3 (4.0)
|
### Summary PyMongo percent-decoded the entire host section of a connection string befor… | pymongo | 2026-10-15T10:22:46.035003Z | 2026-10-15T14:38:08.842297Z |
| pysec-2026-4296 |
8.4 (3.1)
7.5 (4.0)
|
An integer overflow in the BSON document encoding component of the MongoDB Python Driver'… | pymongo | 2026-10-15T10:22:46.249312Z | 2026-10-15T14:38:08.667294Z |
| pysec-2026-4295 |
5.0 (3.1)
5.3 (4.0)
|
### Summary PyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, … | pymongo | 2026-10-15T10:22:45.786992Z | 2026-10-15T14:38:08.505615Z |
| pysec-2026-4294 |
6.1 (4.0)
|
### Impact When reading/writing via an ID with the GridFS API, require an exact match on… | pymongo | 2026-10-15T10:22:44.829446Z | 2026-10-15T14:38:08.396105Z |
| pysec-2026-4293 |
6.5 (3.1)
|
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data… | pyload-ng | 2026-10-15T10:22:54.723570Z | 2026-10-15T14:38:08.281197Z |
| pysec-2026-4292 |
5.3 (3.1)
|
### Summary The `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blu… | pyload-ng | 2026-10-15T10:22:54.803402Z | 2026-10-15T14:38:08.177443Z |