Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
| ID | Severity | Description | Package | Published | Updated |
|---|---|---|---|---|---|
| pysec-2025-19 |
9.8 (3.1)
|
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for … | picklescan | 2025-03-03T19:15:34+00:00 | 2027-07-09T15:54:00+00:00 |
| pysec-2024-115 |
9.8 (3.1)
|
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community versi… | langchain-community | 2024-11-05T16:04:14Z | 2027-07-09T15:45:00Z |
| pysec-2025-102 |
6.6 (3.1)
|
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows at… | dagster-ge | 2025-07-22T17:15:33.543Z | 2026-10-09T22:09:00.512099Z |
| pysec-2026-4199 |
6.5 (3.1)
|
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, struc… | vllm | 2026-10-05T23:17:02.467Z | 2026-10-08T09:43:24.725362Z |
| pysec-2026-4198 |
4.2 (3.1)
|
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash… | vllm | 2026-10-05T23:17:02.167Z | 2026-10-08T09:43:24.663438Z |
| pysec-2026-4197 |
6.5 (3.1)
|
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the d… | vllm | 2026-10-05T23:17:01.867Z | 2026-10-08T09:43:24.599253Z |
| pysec-2026-4196 |
7.5 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:58.097Z | 2026-10-08T09:43:12.673977Z |
| pysec-2026-4195 |
6.5 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.943Z | 2026-10-08T09:43:12.609211Z |
| pysec-2026-4194 |
4.3 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.633Z | 2026-10-08T09:43:12.545255Z |
| pysec-2026-4193 |
5.3 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.480Z | 2026-10-08T09:43:12.481383Z |
| pysec-2026-4192 |
7.8 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.330Z | 2026-10-08T09:43:12.417678Z |
| pysec-2026-4191 |
8.8 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.177Z | 2026-10-08T09:43:12.353314Z |
| pysec-2026-4190 |
5.8 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:57.030Z | 2026-10-08T09:43:12.289524Z |
| pysec-2026-4189 |
5.3 (3.1)
|
Docling simplifies document processing by parsing diverse formats and providing integrati… | docling | 2026-10-05T22:16:56.867Z | 2026-10-08T09:43:12.225434Z |
| pysec-2026-4188 |
6.3 (3.1)
|
Apache Airflow's Snowflake provider did not validate the connection's `account` and `regi… | apache-airflow-providers-snowflake | 2026-09-29T10:17:12.673Z | 2026-10-08T09:43:09.582985Z |
| pysec-2026-4187 |
4.3 (3.1)
|
Apache Airflow's Google provider built Google Drive search expressions by interpolating f… | apache-airflow-providers-google | 2026-09-29T10:17:12.530Z | 2026-10-08T09:43:09.515191Z |
| pysec-2026-2946 |
5.5 (3.1)
|
## Summary The approval system in PraisonAI Agents caches tool approval decisions by too… | praisonaiagents | 2026-07-13T14:36:52.273166Z | 2026-10-07T12:45:35.569370Z |
| pysec-2026-4186 |
7.5 (3.1)
|
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unkno… | vllm | 2026-09-30T17:16:42.570Z | 2026-10-07T09:33:02.891289Z |
| pysec-2026-4185 |
7.5 (3.1)
|
vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bo… | vllm | 2026-09-26T14:16:47.810Z | 2026-10-07T09:33:02.817881Z |
| pysec-2026-4184 |
7.1 (4.0)
|
vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcin… | vllm | 2026-09-26T14:16:47.523Z | 2026-10-07T09:33:02.743096Z |
| pysec-2026-4183 |
8.2 (3.1)
|
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, Py… | pyjwt | 2026-09-28T21:17:15.857Z | 2026-10-07T09:32:59.259517Z |
| pysec-2026-2132 Withdrawn 2026-10-07 |
7.2 (3.1)
|
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the… | click | 2026-04-30T14:16:36.433Z | 2026-10-07T01:44:46Z |
| pysec-2026-4112 |
8.1 (3.1)
|
## Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clip… | notebook | 2026-10-01T16:44:34.145574Z | 2026-10-05T06:24:38.112577Z |
| pysec-2022-43190 |
9.1 (3.1)
|
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the f… | casdoor | 2022-09-09T20:15:11.340Z | 2026-10-04T16:51:55.150728Z |
| pysec-2022-43189 |
7.5 (3.1)
|
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the f… | casdoor | 2022-01-29T23:15:07.540Z | 2026-10-04T09:41:52.857192Z |
| pysec-2026-4182 |
8.7 (4.0)
|
### Impact Denial of service via memory exhaustion. Affects all callers who streamed com… | zapros | 2026-10-01T16:38:38.425485Z | 2026-10-01T17:10:47.715391Z |
| pysec-2026-4181 |
6.9 (4.0)
|
### Impact **Who is impacted**: - Any application using Zapros to make HTTP requests t… | zapros | 2026-10-01T16:38:38.510801Z | 2026-10-01T17:10:47.653559Z |
| pysec-2026-4180 |
2.3 (3.1)
|
### Impact wlc could send an unscoped API token to an unintended server when run inside … | wlc | 2026-10-01T16:38:34.427351Z | 2026-10-01T17:10:47.471692Z |
| pysec-2026-4179 |
6.5 (3.1)
|
### Summary The audio decode-duration guard (`max_duration_s`, env `VLLM_MAX_AUDIO_DECODE… | vllm | 2026-10-01T16:38:32.289483Z | 2026-10-01T17:10:45.836187Z |
| pysec-2026-4178 |
6.5 (3.1)
|
## Summary Current vLLM `main` lets an inference request choose the PyNvVideoCodec GPU v… | vllm | 2026-10-01T16:38:32.983082Z | 2026-10-01T17:10:45.758005Z |