Python
Monthly
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryptographic 'random' module (Mersenne Twister) into openssl_encrypt/modules/pqc.py, though the code makes no calls to it, so no cryptographic operation is presently weakened. VulnCheck reported this as a latent hazard: the import invites future maintainers to reach for random.randint() instead of secrets/os.urandom, which would yield predictable values recoverable from ~624 outputs. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw was fixed by removing the import in version 1.4.0.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Unauthenticated path traversal in the token-optimizer-mcp dashboard server (npm package @ooples/token-optimizer-mcp v5.0.1) allows any network-accessible attacker to read arbitrary .jsonl files from the server's filesystem by supplying a crafted sessionId parameter to /api/session-summary or /api/session-events. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms zero authentication or user interaction is required, and a working proof-of-concept demonstrating successful out-of-bounds file exfiltration has been publicly disclosed in GHSA-76pc-mqxp-3rq5. No active exploitation has been confirmed by CISA KEV, but the trivial exploitation complexity and public PoC make this an immediate priority for any internet-exposed deployment.
SSRF protection in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) is bypassable via DNS rebinding against the `/admin/gateways/test` endpoint, allowing an attacker with a database-backed `gateways.read` role to reach cloud instance metadata services (including 169.254.169.254) and internal network resources. The root cause is a TOCTOU race between the hostname validation step - which resolves DNS via `socket.getaddrinfo()` and checks the result against blocked private ranges - and the `httpx`-based HTTP client's fully independent DNS re-resolution at connection time, with no IP-pinning or validated-address forwarding bridging the two operations. A detailed proof-of-concept is published in GitHub Security Advisory GHSA-9hgc-g3w5-67cm; the vendor confirmed the fix in release v1.0.3 (2026-06-10); no CISA KEV listing is present at time of analysis.
Stored XSS in django-helpdesk before 2.3.3 enables unauthenticated external attackers to inject arbitrary JavaScript into the authenticated staff interface by submitting HTML-formatted ticket email bodies or uploading .html/.htm file attachments through the public-facing ticket submission channel. The payload persists in the helpdesk database and executes in the browser session of any staff member who opens the attachment during routine triage, enabling session hijacking, credential exfiltration, or unauthorized actions performed under the staff member's identity. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Information disclosure in vLLM prior to version 0.26.0 leaks server filesystem internals - including OS usernames, home and virtual-environment directory paths, Python version, internal package structure, line numbers, and endpoint handler names - through HTTP error responses. Any unauthenticated network attacker can trigger this by sending malformed JSON to the OpenAI-compatible API endpoints, requiring zero privileges and no special configuration beyond a default vLLM deployment. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the trivial exploitation bar (a single malformed HTTP request) and the reconnaissance value of the leaked data elevate real-world risk above the CVSS 5.3 score alone implies.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Uncontrolled resource consumption in Django REST Framework prior to 3.17.2 allows unauthenticated remote attackers to exhaust server memory and CPU by sending arbitrarily large request bodies via application/json or application/x-www-form-urlencoded content types. The framework's Request._parse() method passes the raw HttpRequest stream directly to JSONParser and FormParser, silently bypassing Django's built-in DATA_UPLOAD_MAX_MEMORY_SIZE guard. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any exposed DRF API endpoint a viable target.
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Arbitrary file write via tar path traversal in Fledge's backup-restore API allows an authenticated admin to overwrite files anywhere on the host filesystem reachable by the Fledge process. The upload_backup() handler in backup_restore.py calls Python's tarfile.extractall() without a filter argument or member-path sanitization, enabling a classic 'tar slip' attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is mechanically trivial for any actor holding admin credentials.
Authorization bypass in the TicketDetailView component of Ehco1996 django-sspanel allows authenticated remote users to access support tickets belonging to other users by manipulating a user-controlled key in requests to apps/sspanel/views.py. All releases through 2023.12.26 are affected per ENISA EUVD-2026-52981. No patch will be issued - the maintainer has abandoned the project and did not respond to disclosure - leaving operators with no vendor remediation path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Catastrophic regex backtracking in Open WebUI 0.9.6-0.10.x allows any authenticated user to permanently stall a Uvicorn event-loop worker by supplying a crafted pattern to the built-in knowledge-search tool. The vulnerable `grep_knowledge_files` tool compiles attacker-supplied patterns with Python's unbounded `re` engine against attacker-uploaded file content, with no timeout anywhere on the execution path; a 30-character subject string measured at 74 seconds of CPU and a 40-character string extrapolates to roughly one day. No CISA KEV listing exists, but a complete proof-of-concept procedure is published in the GitHub security advisory GHSA-2f54-p244-32q6, making exploitation straightforward for any credential holder.
Tool source code disclosure in Open WebUI (≤ 0.10.2) allows any authenticated non-admin user who holds a read grant on a shared workspace tool to retrieve the full Python source of that tool via three unguarded API endpoints. The root cause is a Pydantic response-model inheritance defect where the `ToolUserResponse` subclass re-admitted the `content` field that the parent `ToolResponse` schema deliberately excluded, combined with a separate query-level defect in the list path. Because tool source commonly embeds hard-coded API keys, credentials, and internal service URLs, the practical confidentiality loss frequently exceeds the code itself; a detailed proof-of-concept is published in the GitHub security advisory, and the vendor-confirmed fix is available in 0.11.0 with no active exploitation (CISA KEV) recorded at time of analysis.
Stored cross-site scripting in Django admin's URLField rendering allows a malicious URL value (e.g., using a `javascript:` scheme) to be displayed as a clickable link on changelist views and read-only admin fields without scheme validation. Any application that accepts URLField input via public-facing forms and exposes those records in the Django admin is affected, covering Django 5.2 through the 6.1 release candidate. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; patches were released August 4, 2026 as Django 5.2.17 and 6.0.8.
Memory exhaustion in Django's `check_for_language()` function allows denial-of-service via the `set_language` view when it is explicitly enabled in URL configuration. Attackers can submit many distinct, very long language codes via POST requests, causing each code to be cached as an in-memory key and progressively consuming process memory. Django rates this severity 'low' because built-in guards - `DATA_UPLOAD_MAX_MEMORY_SIZE` and the cache's maximum entry count - bound the total exploitable memory; no public exploit identified at time of analysis.
Denial-of-service via recursive GEOMETRYCOLLECTION parsing crashes Django processes through a segmentation fault in the underlying GEOS library. Django's GEOSGeometry class, GeometryField form field, and spatial field lookups in versions 5.2, 6.0, 6.1 (RC), and main are all affected when processing WKT or WKB input containing deeply nested or excessively numerous GEOMETRYCOLLECTION objects. No public exploit code or active exploitation has been identified at time of analysis; the Django team rated this 'moderate' severity and issued fixed releases Django 5.2.17 and 6.0.8 on August 4, 2026.
Code injection in VibeSurf's Python Validation Handler enables remote unauthenticated attackers to inject and execute arbitrary Python code by manipulating the /code endpoint. All versions up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 are confirmed affected per EUVD-2026-52704. No patch is available - the vendor did not respond to disclosure - and a public proof-of-concept exists (CVSS 4.0 E:P, corroborated by an asciinema recording in the references), making exploitation accessible to low-skilled attackers.
Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearing *.example.com to satisfy a constrained intermediate CA's permittedSubtrees restriction of foo.example.com, enabling scope escape to sibling domains such as bar.example.com. Applications relying on the PolicyBuilder/Store verification API are exposed to acceptance of invalid certificate chains that should be rejected per RFC 5280 §4.2.1.10. A public proof-of-concept is confirmed in the GHSA advisory; the vulnerability is not in the CISA KEV catalog, but the CVSS 4.0 E:P modifier reflects the POC's availability.
HTTP request smuggling in aiohttp's server-side parser allows unauthenticated remote attackers to inject and misdirect HTTP traffic by exploiting a protocol-switch race in the WebSocket upgrade path. Versions 3.14.1 and earlier prematurely mark the connection as upgraded before the full request body is consumed, causing trailing bytes - potentially an attacker-controlled HTTP request - to be interpreted as WebSocket or pipelined data by the server or any upstream proxy. No public exploit code exists and the vulnerability is not listed in CISA KEV, but CVSS 4.0 AC:H reflects the edge-case nature of the trigger condition.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Unsafe tar extraction in Penelope Shell Handler (pip package penelope-shell-handler, versions prior to 0.19.3) enables a malicious or compromised remote session to write arbitrary files on the penetration tester's (operator's) machine by returning a crafted tar archive containing path-traversal entries such as `../`. The vulnerability is exclusively triggered by the Unix `download` command path and can be chained to operator-side code execution by overwriting `~/.penelope/peneloperc`, which Penelope `exec()`s on startup and on `reload`. A fully working proof-of-concept is included in the GitHub Security Advisory, demonstrating the complete file-write-to-RCE chain. No public record of active exploitation (CISA KEV) has been identified at time of analysis.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Path traversal in pymdown-extensions' b64 extension allows remote attackers to read arbitrary image-extension files inside the configured base_path directory by injecting '../' or absolute paths in image src attributes, leading to disclosure of file contents as base64 in rendered HTML. The vulnerability affects pymdown-extensions <=10.21.3, and a publicly available proof-of-concept exists. Exploitation requires the b64 extension to be enabled and attacker-controlled Markdown input.
We need to produce a JSON object with all fields specified. The input provides extensive details about CVE-2026-63632. Let's synthesize the data. First, we need to identify product_name: The CVE is about ONNX, specifically the Python package "onnx". The vulnerability is in the version converter of ONNX. So product_name should be "onnx" (the package). But the instruction says "1-3 words ONLY. The specific product or service name affected. ... If multiple products, pick the primary one." Here the primary product is the onnx package. So "onnx". Now summary: Should be an original synthesis, not just a paraphrase. "Remote code execution"? No, it's not RCE. It's a heap buffer overflow read, leading to information disclosure and crashes. Description says OOB read propagates leaked heap data into model output shape, potentially leaking heap data. No exploitation demonstrated beyond info leak and crash. CVSS vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low availability impact). That's local, requires user interaction, no privilege required, no confidentiality or integrity impact. So the vulnerability allows a local attacker, via a crafted model, to cause a heap buffer over-read, leading to potential information disclosure (heap data in output shape) and crashes. It's a silent leak on release builds. So summary: "Heap buffer over-read in onnx version_converter during opset downgrade of Gemm node can leak heap data or crash when processing a crafted model with undersized input tensors. Affects onnx package versions 1.3.0 to 1.21.0." Add also "publicly available exploit code exists" and EPSS? Not provided, we can't calculate EPSS. But no EPSS data in input. The summary must mention actively exploited? KEV status? Not in KEV list. So "publicly available exploit code exists" if POC available. POC/Exploit: Publicly available from the input. So "publicly available exploit code exists". Also mention "no public exploit identified at time of analysis" is not correct as POC is availa
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level `.mcp.json` file that the tool automatically loads via `subprocess.Popen` in `minicode/config.py`. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Server-side request forgery in the strands-agents-tools elasticsearch_memory tool enables prompt-injection attacks that exfiltrate the operator's Elasticsearch API key to attacker-controlled infrastructure. Applications using strands-agents-tools prior to 0.7.0 that rely on the ELASTICSEARCH_API_KEY environment-variable fallback - rather than explicitly passing api_key - are exposed to credential theft when an attacker can influence LLM input. No public exploit code or CISA KEV listing has been identified at time of analysis, but the prompt-injection-to-SSRF primitive is well understood in the AI agent security community and the credential-theft impact warrants prompt remediation.
Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directory escape that can read or overwrite arbitrary files on the host filesystem. The root defect is in `keras/src/utils/file_utils.py`, where `is_path_in_dir` path containment checks are applied only to regular file entries - symlink entries are extracted without equivalent validation. The exposure is most severe on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole extraction safeguard; no public exploit or active exploitation has been identified at time of analysis.
Unauthorized schema disclosure in Grist Core prior to 1.7.15 allows any user with partial read access - explicitly including anonymous public users on publicly viewable documents - to retrieve table and column metadata for any widget by querying the GET /forms endpoint. The endpoint failed both to validate that the requested section was a form widget and to apply the document's configured access rules before returning metadata, meaning hidden schema structure (table names, column names, types) is fully exposed regardless of the restrictions in place. No public exploit has been identified and the vulnerability is not in CISA KEV; a vendor-released patch exists in version 1.7.15.
Path traversal in psd-tools through v1.17.0 exposes any application processing untrusted PSD files to arbitrary file write and secondary arbitrary file read via the SmartObject API. SmartObject.save() consumes the embedded smart-object filename verbatim from the PSD binary - without basename stripping, absolute-path rejection, or directory-escape filtering - allowing a crafted PSD to write attacker-supplied bytes to any path the process can reach. A secondary issue in SmartObject.open() for external-kind objects uses the attacker-controlled fullPath descriptor as a read source, enabling file exfiltration to the write destination. A standalone proof-of-concept is publicly confirmed in the advisory; the fix is vendor-confirmed in v1.17.1 (PR #657). No public exploit identified at time of analysis beyond the advisory-embedded POC, and no CISA KEV listing was found.
Improper access control in manjurulhoque's django-job-portal allows authenticated remote attackers to manipulate the `role` argument via the `EditEmployeeProfileAPIView` endpoint, enabling unauthorized privilege escalation within the Employee Dashboard. All commits up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f are affected under a rolling release model with no fixed version available. A publicly available proof-of-concept exploit exists via GitHub issue #91; the project maintainer has not responded to disclosure and no patch has been released.
Memory exhaustion in pyload's EventManager module allows authenticated remote attackers to cause a denial of service by sending large volumes of requests to the getEvents API endpoint with unique UUIDs. Each unique UUID causes a new Client instance to be appended to the internal clients list, but the existing clean() method that would purge inactive clients is never invoked anywhere in the codebase, resulting in unbounded memory growth. No public exploit is independently catalogued, but a functional proof-of-concept script was included in the disclosure, demonstrating that the attack can be executed with a valid API key and approximately 100,000 HTTP GET requests.
SSRF protection bypass in pyload-ng allows authenticated users with link-add permissions to reach internal network endpoints - including cloud metadata services - by supplying IPv6 transition-encoded addresses that Python's `ipaddress.IPv6Address.is_global` incorrectly classifies as globally routable. The NAT64 prefix (`64:ff9b::/96`) bypass is universal across all supported Python versions (3.9-3.14); the 6to4 prefix (`2002::/16`) bypass additionally affects Python 3.9-3.11, covering the full `python_requires = >=3.9` matrix. No confirmed active exploitation (CISA KEV) has been identified, but a researcher-provided proof-of-concept demonstrates full bypass of both the `is_global_address` guard and the pycurl PREREQFUNC in `http_request.py:680`.
Path traversal vulnerability in AsyncSSH 2.23.0 allows an unauthenticated remote attacker to bypass the intended authorized-keys directory restriction. By supplying a malicious SSH username containing a tilde (~) or environment variable expansion (${ENV}), the attacker can write to arbitrary files, potentially gaining unauthorized SSH access. Public proof-of-concept exploit code exists, though exploitation is not widespread (EPSS 0.29%).
Server-Side Request Forgery in Python Zeep 4.0.0 through 4.3.2 allows an attacker who can influence WSDL or XSD content parsed by the library to bypass the explicit `Settings.forbid_external` security control, causing the server to issue HTTP or HTTPS requests to attacker-chosen URLs via transitive xsd:import, xsd:include, wsdl:import, or lxml entity and DTD references. The vulnerability is particularly significant because it defeats a documented security setting that developers actively configure to prevent external fetching - applications relying on this control are silently unprotected. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.
Uncontrolled resource consumption in pypdf prior to 6.14.0 allows unauthenticated remote attackers to cause denial of service by submitting a crafted PDF containing repeated malformed cross-reference streams. The library's XRef table recovery routine performs unbounded work on such inputs, leading to excessive CPU time consumption and effectively hanging or severely degrading any application that processes attacker-supplied PDFs. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in pypdf prior to 6.14.0 allows remote, unauthenticated attackers to exhaust host memory by submitting a crafted PDF containing image metadata with inflated declared sizes that vastly exceed the actual embedded image data. Any application that uses pypdf to parse untrusted PDFs is exposed; the library allocates memory proportional to the declared (attacker-controlled) size rather than the actual data length. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unbounded recursion in Mistune's Include directive (all versions prior to 3.3.0) can be triggered by a pair of mutually-referencing markdown files, bypassing the cycle detector that only checks for direct self-inclusion. An attacker who can supply markdown content processed by an application using the Include directive may crash the rendering request with a Python RecursionError, resulting in a denial of service. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a confirmed fix is available in version 3.3.0.
Path traversal in Mistune's Include plugin allows reading arbitrary files from the server filesystem when processing attacker-controlled markdown. Applications using md.read() with the Include plugin on markdown content supplied by external users are exposed: a crafted include directive can escape the intended markdown base directory to access any file readable by the running process. No public exploit has been identified at time of analysis, but a vendor-released patch is available in version 3.3.0.
Cross-site scripting in Mistune prior to 3.3.0 stems from an incomplete URI scheme blocklist in the `safe_url` filter, permitting legacy and chained schemes (`feed:`, `jar:`, `livescript:`, `mocha:`, `ms-its:`, `mk:`, `res:`, `view-source:`) to pass unchecked into rendered `href` and `src` attributes. Any web application that accepts user-supplied Markdown, renders it via Mistune's HTML renderer, and serves the output to other users' browsers is exposed to stored or reflected XSS. No public exploit or CISA KEV listing has been identified at time of analysis; however, the CVSS 6.1 score with scope change (S:C) reflects genuine cross-session impact when the victim interacts with attacker-controlled content.
Cross-site scripting in Mistune (Python Markdown parser) prior to version 3.2.1 allows injection of arbitrary HTML attributes via the Admonition directive's `:class:` option, critically bypassing HTMLRenderer escape mode even when it is explicitly enabled. Applications that render user-controlled Markdown with admonition directives and serve the resulting HTML to web browsers are exposed to stored or reflected XSS, enabling session hijacking, credential theft, or malicious DOM manipulation. No public exploit has been identified at time of analysis, and a vendor-released patch is available in v3.2.1.
Cross-site scripting in Mistune Python Markdown parser (all versions before 3.3.0) allows attacker-controlled Markdown content containing percent-encoded javascript: URIs to bypass the HTMLRenderer.safe_url() URL sanitization filter and execute arbitrary script in victim browsers. The bypass works because safe_url() checks the raw string without first decoding percent-encoded characters, so schemes like %6Aavascript: or %6aVaScRiPt: evade detection while remaining valid to browsers. Any web application that renders user-supplied or attacker-influenced Markdown through Mistune and serves the output to other users is exposed. No public exploit or CISA KEV listing has been identified at time of analysis.
Predictable heading anchor ID generation in Mistune's toc plugin (all versions prior to 3.3.0) enables same-page navigation hijacking when untrusted Markdown content is rendered. The library assigns sequential numeric identifiers (toc_0, toc_1, etc.) to headings without incorporating heading text, so any party able to inject raw HTML containing a matching id attribute can pre-empt the generated anchor and redirect table-of-contents link targets, CSS selectors, or JavaScript DOM event handlers. No public exploit identified at time of analysis, though the deterministic ID scheme makes collision trivial to engineer once content injection is possible.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in Flask-MonitoringDashboard up to version 5.0.2 allows a remote unauthenticated attacker to trick an authenticated dashboard user into submitting malicious state-changing requests by luring them to a crafted page. The vulnerability (CWE-352) is limited in scope to the monitoring dashboard itself with a low integrity impact and no confidentiality or availability consequence, reflected in the CVSS 4.0 score of 2.1. Exploit details have been publicly disclosed via VulDB submissions and a GitHub issue report, but no patch has been released and the project maintainer has not yet responded to the responsible disclosure.
Header injection in Django's DomainNameValidator allows network attackers to inject arbitrary HTTP response headers when applications pass validator-accepted domain values directly into HTTP responses, affecting Django 6.0 before 6.0.7 and 5.2 before 5.2.16. The validator silently accepts embedded newline characters in domain name strings, enabling HTTP response splitting that can facilitate session hijacking, open redirects, or cross-site scripting against end users. No public exploit code or CISA KEV listing exists at time of analysis; practical risk is narrowed significantly by Django's HttpResponse class independently rejecting newlines, meaning only non-standard code paths are exploitable.
Memory over-read in Django's GIS module allows unauthenticated remote attackers to potentially disclose adjacent heap memory or degrade service availability via a segmentation fault. The `django.contrib.gis.gdal.GDALRaster` class fails to correctly bound its read when constructed from a bytes object, exposing raw memory when the `vsi_buffer` property is subsequently accessed. Affects Django 6.0 before 6.0.7 and 5.2 before 5.2.16; no public exploit identified at time of analysis and not listed in CISA KEV.
Cache poisoning in Django's UpdateCacheMiddleware and cache_page() decorator exposes private user data to unauthenticated remote attackers by incorrectly serving cached responses across different cookie contexts. Versions 6.0 before 6.0.7 and 5.2 before 5.2.16 are confirmed affected; older unsupported branches (5.0.x, 4.1.x, 3.2.x) were not evaluated but may share the flaw. No public exploit or CISA KEV listing exists at time of analysis, and the low CVSS 4.0 score of 2.3 reflects meaningful preconditions, though the data-disclosure consequence for applications serving personalized, cookie-gated content through a shared cache is concrete.
Null pointer dereference in the ONNX Python library's version converter crashes any application that calls `onnx.version_converter.convert_version()` on a crafted model containing an Upsample node with zero inputs, producing an unrecoverable SIGSEGV. Affected versions include at minimum onnx 1.21.0 and 1.22.0, confirmed by a 107-byte public proof-of-concept; the vulnerability is part of a systemic pattern spanning eight adapters. No public active exploitation is confirmed in CISA KEV, but the trivially small PoC eliminates any meaningful exploitation barrier for threat actors targeting ML model conversion pipelines.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
### Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading the "UNIT CELL TRANSLATION" block of a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Security-scanner bypass in Picklescan before 0.0.33 lets attackers smuggle arbitrary-code-execution payloads past its safety checks by abusing the numpy.f2py.crackfortran.getlincoef gadget inside a pickle __reduce__ method, which the scanner fails to flag as dangerous. Because Picklescan is used to vet shared machine-learning model files, a malicious pickle passes as 'clean' and then executes attacker-controlled Python when the trusting downstream consumer deserializes it. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 score is 7.6 and the attack depends on a victim actually loading the file.
Authorization bypass in Wagtail CMS allows authenticated low-privilege users to create translations for pages beyond their permitted scope. Versions prior to 7.0.8, 7.3.3, and 7.4.2 fail to enforce page-level permission checks when a user submits a translation request, exposing content of restricted pages to anyone holding the 'Can submit translation' permission. No public exploit code or active exploitation (CISA KEV) has been identified, but the low attack complexity and network-accessible vector make this straightforward to abuse for information disclosure.
Missing authorization on the image preview endpoint in Wagtail CMS allows any authenticated admin-panel user to render previews of images they do not have permission to access. Affected across three maintained release branches - all Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. No public exploit has been identified at time of analysis, and exploitation is strictly bounded to users holding valid Wagtail admin credentials, making this a privileged-insider or compromised-account risk rather than an external threat.
Wagtail's Documents and Images chooser endpoint leaks asset metadata - including filenames, display names, and URLs - to authenticated admin users who have been explicitly denied collection-level choose permissions. Versions prior to 7.0.8, 7.3.3, and 7.4.2 are affected across the 7.0, 7.3, and 7.4 release branches. An attacker with a valid Wagtail admin account can enumerate restricted media assets across collections beyond their authorized scope, bypassing the collection permission model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Wagtail CMS versions prior to 7.0.8, 7.3.3, and 7.4.2 expose a resource exhaustion vector where authenticated admin users can submit purposefully crafted image filter specification strings that trigger disproportionately expensive rendition processing on the server, resulting in service degradation for all site users. The vulnerability is constrained to admin-level authenticated users and cannot be triggered by ordinary unauthenticated site visitors, materially limiting real-world attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the low-priority tier for most deployments.
### Summary A memory-safety vulnerability in Open Babel's MSI parser allowed an out-of-bounds write into the `translationVectors[]` array when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryptographic 'random' module (Mersenne Twister) into openssl_encrypt/modules/pqc.py, though the code makes no calls to it, so no cryptographic operation is presently weakened. VulnCheck reported this as a latent hazard: the import invites future maintainers to reach for random.randint() instead of secrets/os.urandom, which would yield predictable values recoverable from ~624 outputs. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw was fixed by removing the import in version 1.4.0.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Unauthenticated path traversal in the token-optimizer-mcp dashboard server (npm package @ooples/token-optimizer-mcp v5.0.1) allows any network-accessible attacker to read arbitrary .jsonl files from the server's filesystem by supplying a crafted sessionId parameter to /api/session-summary or /api/session-events. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms zero authentication or user interaction is required, and a working proof-of-concept demonstrating successful out-of-bounds file exfiltration has been publicly disclosed in GHSA-76pc-mqxp-3rq5. No active exploitation has been confirmed by CISA KEV, but the trivial exploitation complexity and public PoC make this an immediate priority for any internet-exposed deployment.
SSRF protection in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) is bypassable via DNS rebinding against the `/admin/gateways/test` endpoint, allowing an attacker with a database-backed `gateways.read` role to reach cloud instance metadata services (including 169.254.169.254) and internal network resources. The root cause is a TOCTOU race between the hostname validation step - which resolves DNS via `socket.getaddrinfo()` and checks the result against blocked private ranges - and the `httpx`-based HTTP client's fully independent DNS re-resolution at connection time, with no IP-pinning or validated-address forwarding bridging the two operations. A detailed proof-of-concept is published in GitHub Security Advisory GHSA-9hgc-g3w5-67cm; the vendor confirmed the fix in release v1.0.3 (2026-06-10); no CISA KEV listing is present at time of analysis.
Stored XSS in django-helpdesk before 2.3.3 enables unauthenticated external attackers to inject arbitrary JavaScript into the authenticated staff interface by submitting HTML-formatted ticket email bodies or uploading .html/.htm file attachments through the public-facing ticket submission channel. The payload persists in the helpdesk database and executes in the browser session of any staff member who opens the attachment during routine triage, enabling session hijacking, credential exfiltration, or unauthorized actions performed under the staff member's identity. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Information disclosure in vLLM prior to version 0.26.0 leaks server filesystem internals - including OS usernames, home and virtual-environment directory paths, Python version, internal package structure, line numbers, and endpoint handler names - through HTTP error responses. Any unauthenticated network attacker can trigger this by sending malformed JSON to the OpenAI-compatible API endpoints, requiring zero privileges and no special configuration beyond a default vLLM deployment. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the trivial exploitation bar (a single malformed HTTP request) and the reconnaissance value of the leaked data elevate real-world risk above the CVSS 5.3 score alone implies.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Terminal escape sequence injection in Bash-it's barbuk theme (versions through 3.2.0) permits a local attacker to execute arbitrary OSC and CSI terminal control sequences in the context of a victim user's terminal emulator simply by placing a crafted pyproject.toml in any directory the victim navigates into. The root cause is that the barbuk theme's __python_venv_prompt function reads the requires-python field via awk without stripping control characters, then concatenates the raw value into PS1 through __prompt-command, causing injected sequences to render on every prompt refresh. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack is low-complexity given the vendor-confirmed fix commit.
Uncontrolled resource consumption in Django REST Framework prior to 3.17.2 allows unauthenticated remote attackers to exhaust server memory and CPU by sending arbitrarily large request bodies via application/json or application/x-www-form-urlencoded content types. The framework's Request._parse() method passes the raw HttpRequest stream directly to JSONParser and FormParser, silently bypassing Django's built-in DATA_UPLOAD_MAX_MEMORY_SIZE guard. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any exposed DRF API endpoint a viable target.
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Arbitrary file write via tar path traversal in Fledge's backup-restore API allows an authenticated admin to overwrite files anywhere on the host filesystem reachable by the Fledge process. The upload_backup() handler in backup_restore.py calls Python's tarfile.extractall() without a filter argument or member-path sanitization, enabling a classic 'tar slip' attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is mechanically trivial for any actor holding admin credentials.
Authorization bypass in the TicketDetailView component of Ehco1996 django-sspanel allows authenticated remote users to access support tickets belonging to other users by manipulating a user-controlled key in requests to apps/sspanel/views.py. All releases through 2023.12.26 are affected per ENISA EUVD-2026-52981. No patch will be issued - the maintainer has abandoned the project and did not respond to disclosure - leaving operators with no vendor remediation path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Catastrophic regex backtracking in Open WebUI 0.9.6-0.10.x allows any authenticated user to permanently stall a Uvicorn event-loop worker by supplying a crafted pattern to the built-in knowledge-search tool. The vulnerable `grep_knowledge_files` tool compiles attacker-supplied patterns with Python's unbounded `re` engine against attacker-uploaded file content, with no timeout anywhere on the execution path; a 30-character subject string measured at 74 seconds of CPU and a 40-character string extrapolates to roughly one day. No CISA KEV listing exists, but a complete proof-of-concept procedure is published in the GitHub security advisory GHSA-2f54-p244-32q6, making exploitation straightforward for any credential holder.
Tool source code disclosure in Open WebUI (≤ 0.10.2) allows any authenticated non-admin user who holds a read grant on a shared workspace tool to retrieve the full Python source of that tool via three unguarded API endpoints. The root cause is a Pydantic response-model inheritance defect where the `ToolUserResponse` subclass re-admitted the `content` field that the parent `ToolResponse` schema deliberately excluded, combined with a separate query-level defect in the list path. Because tool source commonly embeds hard-coded API keys, credentials, and internal service URLs, the practical confidentiality loss frequently exceeds the code itself; a detailed proof-of-concept is published in the GitHub security advisory, and the vendor-confirmed fix is available in 0.11.0 with no active exploitation (CISA KEV) recorded at time of analysis.
Stored cross-site scripting in Django admin's URLField rendering allows a malicious URL value (e.g., using a `javascript:` scheme) to be displayed as a clickable link on changelist views and read-only admin fields without scheme validation. Any application that accepts URLField input via public-facing forms and exposes those records in the Django admin is affected, covering Django 5.2 through the 6.1 release candidate. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; patches were released August 4, 2026 as Django 5.2.17 and 6.0.8.
Memory exhaustion in Django's `check_for_language()` function allows denial-of-service via the `set_language` view when it is explicitly enabled in URL configuration. Attackers can submit many distinct, very long language codes via POST requests, causing each code to be cached as an in-memory key and progressively consuming process memory. Django rates this severity 'low' because built-in guards - `DATA_UPLOAD_MAX_MEMORY_SIZE` and the cache's maximum entry count - bound the total exploitable memory; no public exploit identified at time of analysis.
Denial-of-service via recursive GEOMETRYCOLLECTION parsing crashes Django processes through a segmentation fault in the underlying GEOS library. Django's GEOSGeometry class, GeometryField form field, and spatial field lookups in versions 5.2, 6.0, 6.1 (RC), and main are all affected when processing WKT or WKB input containing deeply nested or excessively numerous GEOMETRYCOLLECTION objects. No public exploit code or active exploitation has been identified at time of analysis; the Django team rated this 'moderate' severity and issued fixed releases Django 5.2.17 and 6.0.8 on August 4, 2026.
Code injection in VibeSurf's Python Validation Handler enables remote unauthenticated attackers to inject and execute arbitrary Python code by manipulating the /code endpoint. All versions up to commit cd6e519d507cdd4d63061300bf60fb176e1f57e0 are confirmed affected per EUVD-2026-52704. No patch is available - the vendor did not respond to disclosure - and a public proof-of-concept exists (CVSS 4.0 E:P, corroborated by an asciinema recording in the references), making exploitation accessible to low-skilled attackers.
Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearing *.example.com to satisfy a constrained intermediate CA's permittedSubtrees restriction of foo.example.com, enabling scope escape to sibling domains such as bar.example.com. Applications relying on the PolicyBuilder/Store verification API are exposed to acceptance of invalid certificate chains that should be rejected per RFC 5280 §4.2.1.10. A public proof-of-concept is confirmed in the GHSA advisory; the vulnerability is not in the CISA KEV catalog, but the CVSS 4.0 E:P modifier reflects the POC's availability.
HTTP request smuggling in aiohttp's server-side parser allows unauthenticated remote attackers to inject and misdirect HTTP traffic by exploiting a protocol-switch race in the WebSocket upgrade path. Versions 3.14.1 and earlier prematurely mark the connection as upgraded before the full request body is consumed, causing trailing bytes - potentially an attacker-controlled HTTP request - to be interpreted as WebSocket or pipelined data by the server or any upstream proxy. No public exploit code exists and the vulnerability is not listed in CISA KEV, but CVSS 4.0 AC:H reflects the edge-case nature of the trigger condition.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Unsafe tar extraction in Penelope Shell Handler (pip package penelope-shell-handler, versions prior to 0.19.3) enables a malicious or compromised remote session to write arbitrary files on the penetration tester's (operator's) machine by returning a crafted tar archive containing path-traversal entries such as `../`. The vulnerability is exclusively triggered by the Unix `download` command path and can be chained to operator-side code execution by overwriting `~/.penelope/peneloperc`, which Penelope `exec()`s on startup and on `reload`. A fully working proof-of-concept is included in the GitHub Security Advisory, demonstrating the complete file-write-to-RCE chain. No public record of active exploitation (CISA KEV) has been identified at time of analysis.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Path traversal in pymdown-extensions' b64 extension allows remote attackers to read arbitrary image-extension files inside the configured base_path directory by injecting '../' or absolute paths in image src attributes, leading to disclosure of file contents as base64 in rendered HTML. The vulnerability affects pymdown-extensions <=10.21.3, and a publicly available proof-of-concept exists. Exploitation requires the b64 extension to be enabled and attacker-controlled Markdown input.
We need to produce a JSON object with all fields specified. The input provides extensive details about CVE-2026-63632. Let's synthesize the data. First, we need to identify product_name: The CVE is about ONNX, specifically the Python package "onnx". The vulnerability is in the version converter of ONNX. So product_name should be "onnx" (the package). But the instruction says "1-3 words ONLY. The specific product or service name affected. ... If multiple products, pick the primary one." Here the primary product is the onnx package. So "onnx". Now summary: Should be an original synthesis, not just a paraphrase. "Remote code execution"? No, it's not RCE. It's a heap buffer overflow read, leading to information disclosure and crashes. Description says OOB read propagates leaked heap data into model output shape, potentially leaking heap data. No exploitation demonstrated beyond info leak and crash. CVSS vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low availability impact). That's local, requires user interaction, no privilege required, no confidentiality or integrity impact. So the vulnerability allows a local attacker, via a crafted model, to cause a heap buffer over-read, leading to potential information disclosure (heap data in output shape) and crashes. It's a silent leak on release builds. So summary: "Heap buffer over-read in onnx version_converter during opset downgrade of Gemm node can leak heap data or crash when processing a crafted model with undersized input tensors. Affects onnx package versions 1.3.0 to 1.21.0." Add also "publicly available exploit code exists" and EPSS? Not provided, we can't calculate EPSS. But no EPSS data in input. The summary must mention actively exploited? KEV status? Not in KEV list. So "publicly available exploit code exists" if POC available. POC/Exploit: Publicly available from the input. So "publicly available exploit code exists". Also mention "no public exploit identified at time of analysis" is not correct as POC is availa
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level `.mcp.json` file that the tool automatically loads via `subprocess.Popen` in `minicode/config.py`. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Server-side request forgery in the strands-agents-tools elasticsearch_memory tool enables prompt-injection attacks that exfiltrate the operator's Elasticsearch API key to attacker-controlled infrastructure. Applications using strands-agents-tools prior to 0.7.0 that rely on the ELASTICSEARCH_API_KEY environment-variable fallback - rather than explicitly passing api_key - are exposed to credential theft when an attacker can influence LLM input. No public exploit code or CISA KEV listing has been identified at time of analysis, but the prompt-injection-to-SSRF primitive is well understood in the AI agent security community and the credential-theft impact warrants prompt remediation.
Symlink entries in malicious tar archives bypass the `filter_safe_tarinfos` validation in Keras 3.12.0, enabling directory escape that can read or overwrite arbitrary files on the host filesystem. The root defect is in `keras/src/utils/file_utils.py`, where `is_path_in_dir` path containment checks are applied only to regular file entries - symlink entries are extracted without equivalent validation. The exposure is most severe on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole extraction safeguard; no public exploit or active exploitation has been identified at time of analysis.
Unauthorized schema disclosure in Grist Core prior to 1.7.15 allows any user with partial read access - explicitly including anonymous public users on publicly viewable documents - to retrieve table and column metadata for any widget by querying the GET /forms endpoint. The endpoint failed both to validate that the requested section was a form widget and to apply the document's configured access rules before returning metadata, meaning hidden schema structure (table names, column names, types) is fully exposed regardless of the restrictions in place. No public exploit has been identified and the vulnerability is not in CISA KEV; a vendor-released patch exists in version 1.7.15.
Path traversal in psd-tools through v1.17.0 exposes any application processing untrusted PSD files to arbitrary file write and secondary arbitrary file read via the SmartObject API. SmartObject.save() consumes the embedded smart-object filename verbatim from the PSD binary - without basename stripping, absolute-path rejection, or directory-escape filtering - allowing a crafted PSD to write attacker-supplied bytes to any path the process can reach. A secondary issue in SmartObject.open() for external-kind objects uses the attacker-controlled fullPath descriptor as a read source, enabling file exfiltration to the write destination. A standalone proof-of-concept is publicly confirmed in the advisory; the fix is vendor-confirmed in v1.17.1 (PR #657). No public exploit identified at time of analysis beyond the advisory-embedded POC, and no CISA KEV listing was found.
Improper access control in manjurulhoque's django-job-portal allows authenticated remote attackers to manipulate the `role` argument via the `EditEmployeeProfileAPIView` endpoint, enabling unauthorized privilege escalation within the Employee Dashboard. All commits up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f are affected under a rolling release model with no fixed version available. A publicly available proof-of-concept exploit exists via GitHub issue #91; the project maintainer has not responded to disclosure and no patch has been released.
Memory exhaustion in pyload's EventManager module allows authenticated remote attackers to cause a denial of service by sending large volumes of requests to the getEvents API endpoint with unique UUIDs. Each unique UUID causes a new Client instance to be appended to the internal clients list, but the existing clean() method that would purge inactive clients is never invoked anywhere in the codebase, resulting in unbounded memory growth. No public exploit is independently catalogued, but a functional proof-of-concept script was included in the disclosure, demonstrating that the attack can be executed with a valid API key and approximately 100,000 HTTP GET requests.
SSRF protection bypass in pyload-ng allows authenticated users with link-add permissions to reach internal network endpoints - including cloud metadata services - by supplying IPv6 transition-encoded addresses that Python's `ipaddress.IPv6Address.is_global` incorrectly classifies as globally routable. The NAT64 prefix (`64:ff9b::/96`) bypass is universal across all supported Python versions (3.9-3.14); the 6to4 prefix (`2002::/16`) bypass additionally affects Python 3.9-3.11, covering the full `python_requires = >=3.9` matrix. No confirmed active exploitation (CISA KEV) has been identified, but a researcher-provided proof-of-concept demonstrates full bypass of both the `is_global_address` guard and the pycurl PREREQFUNC in `http_request.py:680`.
Path traversal vulnerability in AsyncSSH 2.23.0 allows an unauthenticated remote attacker to bypass the intended authorized-keys directory restriction. By supplying a malicious SSH username containing a tilde (~) or environment variable expansion (${ENV}), the attacker can write to arbitrary files, potentially gaining unauthorized SSH access. Public proof-of-concept exploit code exists, though exploitation is not widespread (EPSS 0.29%).
Server-Side Request Forgery in Python Zeep 4.0.0 through 4.3.2 allows an attacker who can influence WSDL or XSD content parsed by the library to bypass the explicit `Settings.forbid_external` security control, causing the server to issue HTTP or HTTPS requests to attacker-chosen URLs via transitive xsd:import, xsd:include, wsdl:import, or lxml entity and DTD references. The vulnerability is particularly significant because it defeats a documented security setting that developers actively configure to prevent external fetching - applications relying on this control are silently unprotected. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.
Uncontrolled resource consumption in pypdf prior to 6.14.0 allows unauthenticated remote attackers to cause denial of service by submitting a crafted PDF containing repeated malformed cross-reference streams. The library's XRef table recovery routine performs unbounded work on such inputs, leading to excessive CPU time consumption and effectively hanging or severely degrading any application that processes attacker-supplied PDFs. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in pypdf prior to 6.14.0 allows remote, unauthenticated attackers to exhaust host memory by submitting a crafted PDF containing image metadata with inflated declared sizes that vastly exceed the actual embedded image data. Any application that uses pypdf to parse untrusted PDFs is exposed; the library allocates memory proportional to the declared (attacker-controlled) size rather than the actual data length. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unbounded recursion in Mistune's Include directive (all versions prior to 3.3.0) can be triggered by a pair of mutually-referencing markdown files, bypassing the cycle detector that only checks for direct self-inclusion. An attacker who can supply markdown content processed by an application using the Include directive may crash the rendering request with a Python RecursionError, resulting in a denial of service. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a confirmed fix is available in version 3.3.0.
Path traversal in Mistune's Include plugin allows reading arbitrary files from the server filesystem when processing attacker-controlled markdown. Applications using md.read() with the Include plugin on markdown content supplied by external users are exposed: a crafted include directive can escape the intended markdown base directory to access any file readable by the running process. No public exploit has been identified at time of analysis, but a vendor-released patch is available in version 3.3.0.
Cross-site scripting in Mistune prior to 3.3.0 stems from an incomplete URI scheme blocklist in the `safe_url` filter, permitting legacy and chained schemes (`feed:`, `jar:`, `livescript:`, `mocha:`, `ms-its:`, `mk:`, `res:`, `view-source:`) to pass unchecked into rendered `href` and `src` attributes. Any web application that accepts user-supplied Markdown, renders it via Mistune's HTML renderer, and serves the output to other users' browsers is exposed to stored or reflected XSS. No public exploit or CISA KEV listing has been identified at time of analysis; however, the CVSS 6.1 score with scope change (S:C) reflects genuine cross-session impact when the victim interacts with attacker-controlled content.
Cross-site scripting in Mistune (Python Markdown parser) prior to version 3.2.1 allows injection of arbitrary HTML attributes via the Admonition directive's `:class:` option, critically bypassing HTMLRenderer escape mode even when it is explicitly enabled. Applications that render user-controlled Markdown with admonition directives and serve the resulting HTML to web browsers are exposed to stored or reflected XSS, enabling session hijacking, credential theft, or malicious DOM manipulation. No public exploit has been identified at time of analysis, and a vendor-released patch is available in v3.2.1.
Cross-site scripting in Mistune Python Markdown parser (all versions before 3.3.0) allows attacker-controlled Markdown content containing percent-encoded javascript: URIs to bypass the HTMLRenderer.safe_url() URL sanitization filter and execute arbitrary script in victim browsers. The bypass works because safe_url() checks the raw string without first decoding percent-encoded characters, so schemes like %6Aavascript: or %6aVaScRiPt: evade detection while remaining valid to browsers. Any web application that renders user-supplied or attacker-influenced Markdown through Mistune and serves the output to other users is exposed. No public exploit or CISA KEV listing has been identified at time of analysis.
Predictable heading anchor ID generation in Mistune's toc plugin (all versions prior to 3.3.0) enables same-page navigation hijacking when untrusted Markdown content is rendered. The library assigns sequential numeric identifiers (toc_0, toc_1, etc.) to headings without incorporating heading text, so any party able to inject raw HTML containing a matching id attribute can pre-empt the generated anchor and redirect table-of-contents link targets, CSS selectors, or JavaScript DOM event handlers. No public exploit identified at time of analysis, though the deterministic ID scheme makes collision trivial to engineer once content injection is possible.
Setuptools prior to 83.0.0 fails to normalize Unicode filenames before matching them against MANIFEST.in exclusion patterns on macOS APFS and HFS+ filesystems, allowing files with NFD-normalized on-disk names to silently bypass NFC-encoded exclude, global-exclude, recursive-exclude, and prune directives and be packed into Python source distributions. Python package maintainers developing on macOS face a supply chain risk: sensitive files such as credentials, private keys, or environment configs that are correctly listed in MANIFEST.in for exclusion may still appear in tarballs published to PyPI or private registries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site request forgery in Flask-MonitoringDashboard up to version 5.0.2 allows a remote unauthenticated attacker to trick an authenticated dashboard user into submitting malicious state-changing requests by luring them to a crafted page. The vulnerability (CWE-352) is limited in scope to the monitoring dashboard itself with a low integrity impact and no confidentiality or availability consequence, reflected in the CVSS 4.0 score of 2.1. Exploit details have been publicly disclosed via VulDB submissions and a GitHub issue report, but no patch has been released and the project maintainer has not yet responded to the responsible disclosure.
Header injection in Django's DomainNameValidator allows network attackers to inject arbitrary HTTP response headers when applications pass validator-accepted domain values directly into HTTP responses, affecting Django 6.0 before 6.0.7 and 5.2 before 5.2.16. The validator silently accepts embedded newline characters in domain name strings, enabling HTTP response splitting that can facilitate session hijacking, open redirects, or cross-site scripting against end users. No public exploit code or CISA KEV listing exists at time of analysis; practical risk is narrowed significantly by Django's HttpResponse class independently rejecting newlines, meaning only non-standard code paths are exploitable.
Memory over-read in Django's GIS module allows unauthenticated remote attackers to potentially disclose adjacent heap memory or degrade service availability via a segmentation fault. The `django.contrib.gis.gdal.GDALRaster` class fails to correctly bound its read when constructed from a bytes object, exposing raw memory when the `vsi_buffer` property is subsequently accessed. Affects Django 6.0 before 6.0.7 and 5.2 before 5.2.16; no public exploit identified at time of analysis and not listed in CISA KEV.
Cache poisoning in Django's UpdateCacheMiddleware and cache_page() decorator exposes private user data to unauthenticated remote attackers by incorrectly serving cached responses across different cookie contexts. Versions 6.0 before 6.0.7 and 5.2 before 5.2.16 are confirmed affected; older unsupported branches (5.0.x, 4.1.x, 3.2.x) were not evaluated but may share the flaw. No public exploit or CISA KEV listing exists at time of analysis, and the low CVSS 4.0 score of 2.3 reflects meaningful preconditions, though the data-disclosure consequence for applications serving personalized, cookie-gated content through a shared cache is concrete.
Null pointer dereference in the ONNX Python library's version converter crashes any application that calls `onnx.version_converter.convert_version()` on a crafted model containing an Upsample node with zero inputs, producing an unrecoverable SIGSEGV. Affected versions include at minimum onnx 1.21.0 and 1.22.0, confirmed by a 107-byte public proof-of-concept; the vulnerability is part of a systemic pattern spanning eight adapters. No public active exploitation is confirmed in CISA KEV, but the trivially small PoC eliminates any meaningful exploitation barrier for threat actors targeting ML model conversion pipelines.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
### Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading the "UNIT CELL TRANSLATION" block of a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Security-scanner bypass in Picklescan before 0.0.33 lets attackers smuggle arbitrary-code-execution payloads past its safety checks by abusing the numpy.f2py.crackfortran.getlincoef gadget inside a pickle __reduce__ method, which the scanner fails to flag as dangerous. Because Picklescan is used to vet shared machine-learning model files, a malicious pickle passes as 'clean' and then executes attacker-controlled Python when the trusting downstream consumer deserializes it. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 score is 7.6 and the attack depends on a victim actually loading the file.
Authorization bypass in Wagtail CMS allows authenticated low-privilege users to create translations for pages beyond their permitted scope. Versions prior to 7.0.8, 7.3.3, and 7.4.2 fail to enforce page-level permission checks when a user submits a translation request, exposing content of restricted pages to anyone holding the 'Can submit translation' permission. No public exploit code or active exploitation (CISA KEV) has been identified, but the low attack complexity and network-accessible vector make this straightforward to abuse for information disclosure.
Missing authorization on the image preview endpoint in Wagtail CMS allows any authenticated admin-panel user to render previews of images they do not have permission to access. Affected across three maintained release branches - all Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. No public exploit has been identified at time of analysis, and exploitation is strictly bounded to users holding valid Wagtail admin credentials, making this a privileged-insider or compromised-account risk rather than an external threat.
Wagtail's Documents and Images chooser endpoint leaks asset metadata - including filenames, display names, and URLs - to authenticated admin users who have been explicitly denied collection-level choose permissions. Versions prior to 7.0.8, 7.3.3, and 7.4.2 are affected across the 7.0, 7.3, and 7.4 release branches. An attacker with a valid Wagtail admin account can enumerate restricted media assets across collections beyond their authorized scope, bypassing the collection permission model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Wagtail CMS versions prior to 7.0.8, 7.3.3, and 7.4.2 expose a resource exhaustion vector where authenticated admin users can submit purposefully crafted image filter specification strings that trigger disproportionately expensive rendition processing on the server, resulting in service degradation for all site users. The vulnerability is constrained to admin-level authenticated users and cannot be triggered by ordinary unauthenticated site visitors, materially limiting real-world attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the low-priority tier for most deployments.
### Summary A memory-safety vulnerability in Open Babel's MSI parser allowed an out-of-bounds write into the `translationVectors[]` array when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.