Python
Monthly
Out-of-bounds heap read in aiohttp's C HTTP response parser (versions ≤ 3.14.2) allows an attacker-controlled server to crash the client application via a malformed chunked HTTP response, causing denial of service. The flaw exists only when the compiled C extension is active - the default installation mode - and is triggered during error-message construction in aiohttp/_http_parser.pyx when the llhttp error-position pointer is materialized as a raw pointer rather than a bounded offset into the Python bytes buffer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in aiohttp's server-side parser allows unauthenticated remote attackers to inject and misdirect HTTP traffic by exploiting a protocol-switch race in the WebSocket upgrade path. Versions 3.14.1 and earlier prematurely mark the connection as upgraded before the full request body is consumed, causing trailing bytes - potentially an attacker-controlled HTTP request - to be interpreted as WebSocket or pipelined data by the server or any upstream proxy. No public exploit code exists and the vulnerability is not listed in CISA KEV, but CVSS 4.0 AC:H reflects the edge-case nature of the trigger condition.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Arbitrary code execution in the Hugging Face sentence-transformers Python library allows attackers who control the contents of a model directory to run code even when the caller explicitly passes trust_remote_code=False. The import_module_class helper in sentence_transformers/util/misc.py short-circuits its trust gate with an 'or os.path.exists(model_name_or_path)' clause, so any local path that exists satisfies the check and triggers dynamic loading of custom Python (e.g. modeling_*.py referenced in modules.json) at model-load time. This is classic CWE-94 code injection with no public exploit identified at time of analysis; the vendor commit deprecates rather than removes the behavior, deferring the actual fix to v6.0.
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Path traversal in NLTK's NKJPCorpusReader component (versions ≤ 3.9.4) allows attackers who control the `fileids` argument to read arbitrary files outside the configured corpus root, fully defeating the `nltk.pathsec` sandbox even when `ENFORCE=True` is active. The root cause is that `add_root()` builds file paths via plain string concatenation - not the hardened `FileSystemPathPointer` - and downstream code calls the Python builtin `open()` directly, bypassing the `validate_path()` check that NLTK's own SECURITY.md explicitly promises will block unauthorized access. A detailed public PoC is confirmed against nltk 3.9.4; no active exploitation is listed in CISA KEV at time of analysis.
Path traversal in NLTK's FramenetCorpusReader (versions ≤3.9.4) allows a caller-supplied frame name containing ../ sequences to escape the corpus root and read arbitrary XML files accessible to the process, silently bypassing the nltk.pathsec sandbox even when ENFORCE=True is explicitly enabled. Any web service or pipeline that routes user-controlled input into FramenetCorpusReader.frame() is directly exposed, with full parsed content of frame-shaped XML files returned to the caller and a file-existence oracle for all other XML paths. A working proof-of-concept is publicly available in the GitHub security advisory; the vulnerability is not listed in CISA KEV at time of analysis.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. No public exploit identified at time of analysis; this bug is explicitly distinct from and unfixed by the 2.4.2 SandboxedEnvironment patch (GHSA-gphh-9q3h-jgpp / CVE-2026-44209) because the malicious payload is plain text in the rendered body and never touches Jinja attribute access.
Arbitrary file disclosure in the Banks Python prompt-templating library (masci/banks) before 2.4.4 lets attackers who control template variables read any file the Python process can access. All four media filters (image, audio, video, document) wrap untrusted input in Path(value) and feed it straight to open(file_path, "rb") with no sanitization, so path traversal (../) reads files like .env, SSH keys, cloud credentials, source, /etc/passwd and /etc/shadow, returning them base64-encoded in the rendered prompt for trivial exfiltration. No public exploit identified at time of analysis and it is not in CISA KEV, but the fix in 2.4.4 is straightforward to reverse-engineer.
Server-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the server into connecting to an arbitrary host, port, and scheme of their choosing. By exploiting a parser-differential between Python's `urlparse` (used for the issuer allowlist check) and `requests`/`urllib3`/`urllib` (used for OIDC discovery and JWKS retrieval), an attacker crafts a JWT `iss` claim containing a backslash that passes validation but resolves to a different host during the actual fetch. The `iss` claim is only checked in its unverified form, so no legitimate token is needed; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Unsafe tar extraction in Penelope Shell Handler (pip package penelope-shell-handler, versions prior to 0.19.3) enables a malicious or compromised remote session to write arbitrary files on the penetration tester's (operator's) machine by returning a crafted tar archive containing path-traversal entries such as `../`. The vulnerability is exclusively triggered by the Unix `download` command path and can be chained to operator-side code execution by overwriting `~/.penelope/peneloperc`, which Penelope `exec()`s on startup and on `reload`. A fully working proof-of-concept is included in the GitHub Security Advisory, demonstrating the complete file-write-to-RCE chain. No public record of active exploitation (CISA KEV) has been identified at time of analysis.
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when the generated model is imported. Affects versions from 0.11.6 to 0.63.0. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL schema to execute arbitrary Python code when a developer generates and imports the resulting model. The flaw exists because carriage return (\r) characters in Union type descriptions are not neutralized before being placed inside Python line comments, letting the rest of the description escape the comment and run as module‑level code upon import. A fix is available in version 0.60.1; no active exploitation is reported, and no public exploit is known.
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code in generated model files, leading to arbitrary command execution when the module is imported. Affected versions 0.51.0 through 0.60.1 lack proper validation of the `x-python-type` extension, making the attack possible with default tool settings. No public exploit is identified at time of analysis, but the vulnerability is patched in version 0.60.2.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
We need to produce a JSON object with all fields as plain text strings. We have extensive data: CVE description, CVSS vector 3.1, CWE-918 (SSRF), EPSS not provided but we need to estimate? The prompt says "synthesize data from multiple intelligence sources about a CVE into a comprehensive analysis". The sources include references, EPSS, KEV status, patch availability, CPE strings, and tags. In the provided data, I see no EPSS or KEV. So we should note that EPSS is unknown/missing, KEV status not present. Patch is available: fixed in 0.61.0. CPE is pkg:pip/datamodel-code-generator. Tags: Python, SSRF. We need to produce a JSON object. Let's map each required field. 1. **product_name**: "1-3 words ONLY. The specific product or service name affected." It's a Python package: datamodel-code-generator. So product_name = "datamodel-code-generator". 2. **summary**: "2-3 sentence plain-language summary... Do NOT copy or paraphrase the Description... Start with the specific impact verb and product". So: "Server-side request forgery (SSRF) in datamodel-code-generator allows unauthenticated remote attackers to reach internal services via the --url CLI option, exfiltrating responses into generated Python code. The vulnerability affects versions 0.9.1 through 0.60.2 when the [http] extra is installed, and can be triggered by following redirects to private networks. No public exploit activity is confirmed, but a proof-of-concept exists and the vulnerability has been patched in version 0.61.0." We need to mention EPSS and KEV: none. So "no public exploit identified at time of analysis" (since KEV is not true). But we have PoC, so "publicly available exploit code exists". The summary should incorporate that. 3. **technical_context**: Explain underlying technology, CWE-918 (SSRF), how httpx is used, http.get_body implementation, etc. Include CPE data: pip/datamodel-code-generator. Mention that the vulnerability arises from insufficient validation of URLs in the HTTP fetcher, wit
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows unauthenticated attackers who control an input XML Schema to read any file readable by the generator process, with the contents reflected into generated models. A public proof-of-concept exploit exists, and the issue is fixed in version 0.62.0.
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, references, GHSA advisory with detailed description, PoC, patch commit details, CPE. Need to produce JSON fields as instructed. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's extract key info: - Product: "datamodel-code-generator" (pip package, from koxudaxi). Product name should be 1-3 words: "datamodel-code-generator". - Description: Code injection via unescaped carriage return in `--extra-template-data` comment field, fixed in 0.60.2. - CVSS: 7.8, vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE-94: Code Injection. - Tags: Python, RCE, Code Injection, Datamodel Code Generator. - KEV: not mentioned, assume not in KEV. POC: mentioned in advisory (secret gist). But we can't confirm if it's public or private secret gist; the advisory says "Complete self contained POC is available at my secret gist", so the reporter likely privately shared with maintainers? Or the link is there? Since the GHSA description says "PoC available at my secret gist: https://...", but the URL is there. It's a public gist? Might be public. But we don't have explicit POC=YES flag. The tags don't say POC available. Advisory text includes PoC section but the URL is given. Could be public. We'll treat as "publicly available exploit code exists" since the gist URL is embedded in the advisory and likely accessible to anyone who reads it. However, we must be careful: the description says "Complete self contained POC is available at my secret gist" - "secret" might indicate private. But it's in a public security advisory, so it's exposed. It's not a standard public POC, but I'll note it as possible public POC. The instructions say: if POC=YES but no
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
Command injection in NoteGen before 0.32.0 allows remote code execution when an attacker can execute JavaScript in the application webview. The default Tauri shell plugin capability permits execution of bash, python, and python3 with arbitrary arguments, enabling the webview to run OS commands with the app's privileges, typically leading to full host compromise via cross-site scripting.
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to execute arbitrary Python code. By supplying a malicious customBasePath value containing embedded newlines and dot-free expressions, an attacker can inject code that executes when the generated module is imported. A patch is available in version 0.70.0; no public exploit is known at this time.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Path traversal in pymdown-extensions' b64 extension allows remote attackers to read arbitrary image-extension files inside the configured base_path directory by injecting '../' or absolute paths in image src attributes, leading to disclosure of file contents as base64 in rendered HTML. The vulnerability affects pymdown-extensions <=10.21.3, and a publicly available proof-of-concept exists. Exploitation requires the b64 extension to be enabled and attacker-controlled Markdown input.
We need to produce a JSON object with all fields specified. The input provides extensive details about CVE-2026-63632. Let's synthesize the data. First, we need to identify product_name: The CVE is about ONNX, specifically the Python package "onnx". The vulnerability is in the version converter of ONNX. So product_name should be "onnx" (the package). But the instruction says "1-3 words ONLY. The specific product or service name affected. ... If multiple products, pick the primary one." Here the primary product is the onnx package. So "onnx". Now summary: Should be an original synthesis, not just a paraphrase. "Remote code execution"? No, it's not RCE. It's a heap buffer overflow read, leading to information disclosure and crashes. Description says OOB read propagates leaked heap data into model output shape, potentially leaking heap data. No exploitation demonstrated beyond info leak and crash. CVSS vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low availability impact). That's local, requires user interaction, no privilege required, no confidentiality or integrity impact. So the vulnerability allows a local attacker, via a crafted model, to cause a heap buffer over-read, leading to potential information disclosure (heap data in output shape) and crashes. It's a silent leak on release builds. So summary: "Heap buffer over-read in onnx version_converter during opset downgrade of Gemm node can leak heap data or crash when processing a crafted model with undersized input tensors. Affects onnx package versions 1.3.0 to 1.21.0." Add also "publicly available exploit code exists" and EPSS? Not provided, we can't calculate EPSS. But no EPSS data in input. The summary must mention actively exploited? KEV status? Not in KEV list. So "publicly available exploit code exists" if POC available. POC/Exploit: Publicly available from the input. So "publicly available exploit code exists". Also mention "no public exploit identified at time of analysis" is not correct as POC is availa
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary commands inside the Code Interpreter sandbox by embedding shell/argument delimiters in package names passed to install_packages(). Because the CVSS vector is PR:L, an attacker needs some level of authenticated access and the flaw requires user interaction (UI:A) with a high confidentiality and integrity impact (CVSS 4.0 base 8.4). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Command injection in the Ansible Lightspeed extension for Visual Studio Code lets a crafted project achieve arbitrary code execution on a developer's machine. The extension's ansible.python.activationScript setting is treated as a shell command rather than validated as a file path, so when a victim opens or runs a malicious repository, attacker-controlled content in that setting executes with the privileges of the VS Code process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level `.mcp.json` file that the tool automatically loads via `subprocess.Popen` in `minicode/config.py`. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.
Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Authentication bypass in meta-ads-mcp (< 1.0.115) lets an unauthenticated network caller send an arbitrary X-Pipeboard-Token header to slip past AuthInjectionMiddleware and execute every MCP tool using the server operator's Meta Ads credentials. The guard only rejects requests when BOTH an auth token and a pipeboard token are absent, but X-Pipeboard-Token satisfies the pipeboard branch without setting any auth context, causing the token getter to fall back to the operator's META_ACCESS_TOKEN environment variable. A publicly available exploit code exists (detailed PoC with Dockerfile and poc.py), enabling full read and write access to the operator's Meta Ads data; it affects only streamable-http deployments with META_ACCESS_TOKEN configured.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
OS command injection in django-pyas2 through version 1.2.3 lets an authenticated admin plant shell commands in the Partner model's cmd_receive and cmd_send fields, which pyas2/utils.py hands directly to os.system() when an AS2 message is processed. The submitted CVSS vector rates this 9.1 (network, unauthenticated), but the description explicitly requires an authenticated admin user, so real-world exploitability is meaningfully narrower than the headline score. EPSS is low (0.64%, 47th percentile), there is no CISA KEV listing, and a third-party vulnerability-research repository is referenced that appears to document the flaw.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Authentication bypass in HireFlow interview management system (versions 1.2 and earlier) lets unauthenticated remote attackers forge signed session cookies because app.py ships a hard-coded Flask secret_key. Since the key is present in the public source tree, any attacker can mint cookies asserting role=admin and arbitrary user_id values to gain full administrative access. Rated CVSS 10.0; no public exploit is identified at time of analysis, though the flaw is trivially reproducible from the disclosed source value.
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls an OpenAPI description to embed arbitrary Python that executes when a developer generates and imports the resulting client. The flaw stems from unsanitized x-ms-enum.values[].description strings being emitted as inline comments; embedded newlines break out of the comment and run at module scope. No public exploit identified at time of analysis, and the issue is not in CISA KEV. The assigned CVSS 3.1 base score is 7.5, though its impact metrics (C:N/I:N/A:H) understate what is functionally full code execution.
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker who can spoof or tamper with the Ubuntu Pro contract server response to inject arbitrary APT source lines and install malicious root-owned packages. The client builds /etc/apt/sources.list.d entries from the server's directives.suites[] and directives.aptURL fields via Python str.format() without escaping or newline filtering, and passes additionalPackages[] positionally into a root-run apt-get install. Because the component is preinstalled on supported Ubuntu Server releases and auto-attaches on cloud Ubuntu Pro images the exposure is broad; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper TLS hostname verification in the Snowflake Connector for Python (versions before 4.7.1) lets an on-path attacker defeat HTTPS certificate validation, accepting any certificate signed by any trusted CA regardless of the requested hostname. An adversary who can intercept traffic can decrypt and tamper with connector sessions, exposing Snowflake credentials, query results, and staged file data, and can inject arbitrary SQL bounded by the victim role's privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the reporting vendor (Snowflake) rates it CVSS 4.0 9.2.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.
Out-of-bounds heap read in aiohttp's C HTTP response parser (versions ≤ 3.14.2) allows an attacker-controlled server to crash the client application via a malformed chunked HTTP response, causing denial of service. The flaw exists only when the compiled C extension is active - the default installation mode - and is triggered during error-message construction in aiohttp/_http_parser.pyx when the llhttp error-position pointer is materialized as a raw pointer rather than a bounded offset into the Python bytes buffer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in aiohttp's server-side parser allows unauthenticated remote attackers to inject and misdirect HTTP traffic by exploiting a protocol-switch race in the WebSocket upgrade path. Versions 3.14.1 and earlier prematurely mark the connection as upgraded before the full request body is consumed, causing trailing bytes - potentially an attacker-controlled HTTP request - to be interpreted as WebSocket or pipelined data by the server or any upstream proxy. No public exploit code exists and the vulnerability is not listed in CISA KEV, but CVSS 4.0 AC:H reflects the edge-case nature of the trigger condition.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Arbitrary code execution in the Hugging Face sentence-transformers Python library allows attackers who control the contents of a model directory to run code even when the caller explicitly passes trust_remote_code=False. The import_module_class helper in sentence_transformers/util/misc.py short-circuits its trust gate with an 'or os.path.exists(model_name_or_path)' clause, so any local path that exists satisfies the check and triggers dynamic loading of custom Python (e.g. modeling_*.py referenced in modules.json) at model-load time. This is classic CWE-94 code injection with no public exploit identified at time of analysis; the vendor commit deprecates rather than removes the behavior, deferring the actual fix to v6.0.
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Path traversal in NLTK's NKJPCorpusReader component (versions ≤ 3.9.4) allows attackers who control the `fileids` argument to read arbitrary files outside the configured corpus root, fully defeating the `nltk.pathsec` sandbox even when `ENFORCE=True` is active. The root cause is that `add_root()` builds file paths via plain string concatenation - not the hardened `FileSystemPathPointer` - and downstream code calls the Python builtin `open()` directly, bypassing the `validate_path()` check that NLTK's own SECURITY.md explicitly promises will block unauthorized access. A detailed public PoC is confirmed against nltk 3.9.4; no active exploitation is listed in CISA KEV at time of analysis.
Path traversal in NLTK's FramenetCorpusReader (versions ≤3.9.4) allows a caller-supplied frame name containing ../ sequences to escape the corpus root and read arbitrary XML files accessible to the process, silently bypassing the nltk.pathsec sandbox even when ENFORCE=True is explicitly enabled. Any web service or pipeline that routes user-controlled input into FramenetCorpusReader.frame() is directly exposed, with full parsed content of frame-shaped XML files returned to the caller and a file-existence oracle for all other XML paths. A working proof-of-concept is publicly available in the GitHub security advisory; the vulnerability is not listed in CISA KEV at time of analysis.
pgAdmin 4 SERVER mode (versions 9.3 through 9.16) allows authenticated users to fully bypass administrator-configured per-tool role-based access controls by exploiting incomplete permission enforcement across backend routes and Socket.IO handlers. The Flask-Security `permissions_required` decorator was applied only to a single front-door route per tool, while all secondary routes and Socket.IO event handlers checked only authentication, not tool permissions - meaning a user who received a 403 on the initial gated endpoint could still drive the complete tool workflow through its other endpoints. Affected tools include Query Tool, Grant Wizard, Schema Diff, ERD, PSQL (interactive terminal), Debugger, Backup, Restore, Maintenance, and Import/Export. No dedicated public exploit has been identified, though the fix commits and GitHub issue are publicly visible; exploitation requires a valid authenticated pgAdmin session.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. No public exploit identified at time of analysis; this bug is explicitly distinct from and unfixed by the 2.4.2 SandboxedEnvironment patch (GHSA-gphh-9q3h-jgpp / CVE-2026-44209) because the malicious payload is plain text in the rendered body and never touches Jinja attribute access.
Arbitrary file disclosure in the Banks Python prompt-templating library (masci/banks) before 2.4.4 lets attackers who control template variables read any file the Python process can access. All four media filters (image, audio, video, document) wrap untrusted input in Path(value) and feed it straight to open(file_path, "rb") with no sanitization, so path traversal (../) reads files like .env, SSH keys, cloud credentials, source, /etc/passwd and /etc/shadow, returning them base64-encoded in the rendered prompt for trivial exfiltration. No public exploit identified at time of analysis and it is not in CISA KEV, but the fix in 2.4.4 is straightforward to reverse-engineer.
Server-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the server into connecting to an arbitrary host, port, and scheme of their choosing. By exploiting a parser-differential between Python's `urlparse` (used for the issuer allowlist check) and `requests`/`urllib3`/`urllib` (used for OIDC discovery and JWKS retrieval), an attacker crafts a JWT `iss` claim containing a backslash that passes validation but resolves to a different host during the actual fetch. The `iss` claim is only checked in its unverified form, so no legitimate token is needed; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Unsafe tar extraction in Penelope Shell Handler (pip package penelope-shell-handler, versions prior to 0.19.3) enables a malicious or compromised remote session to write arbitrary files on the penetration tester's (operator's) machine by returning a crafted tar archive containing path-traversal entries such as `../`. The vulnerability is exclusively triggered by the Unix `download` command path and can be chained to operator-side code execution by overwriting `~/.penelope/peneloperc`, which Penelope `exec()`s on startup and on `reload`. A fully working proof-of-concept is included in the GitHub Security Advisory, demonstrating the complete file-write-to-RCE chain. No public record of active exploitation (CISA KEV) has been identified at time of analysis.
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when the generated model is imported. Affects versions from 0.11.6 to 0.63.0. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL schema to execute arbitrary Python code when a developer generates and imports the resulting model. The flaw exists because carriage return (\r) characters in Union type descriptions are not neutralized before being placed inside Python line comments, letting the rest of the description escape the comment and run as module‑level code upon import. A fix is available in version 0.60.1; no active exploitation is reported, and no public exploit is known.
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code in generated model files, leading to arbitrary command execution when the module is imported. Affected versions 0.51.0 through 0.60.1 lack proper validation of the `x-python-type` extension, making the attack possible with default tool settings. No public exploit is identified at time of analysis, but the vulnerability is patched in version 0.60.2.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
We need to produce a JSON object with all fields as plain text strings. We have extensive data: CVE description, CVSS vector 3.1, CWE-918 (SSRF), EPSS not provided but we need to estimate? The prompt says "synthesize data from multiple intelligence sources about a CVE into a comprehensive analysis". The sources include references, EPSS, KEV status, patch availability, CPE strings, and tags. In the provided data, I see no EPSS or KEV. So we should note that EPSS is unknown/missing, KEV status not present. Patch is available: fixed in 0.61.0. CPE is pkg:pip/datamodel-code-generator. Tags: Python, SSRF. We need to produce a JSON object. Let's map each required field. 1. **product_name**: "1-3 words ONLY. The specific product or service name affected." It's a Python package: datamodel-code-generator. So product_name = "datamodel-code-generator". 2. **summary**: "2-3 sentence plain-language summary... Do NOT copy or paraphrase the Description... Start with the specific impact verb and product". So: "Server-side request forgery (SSRF) in datamodel-code-generator allows unauthenticated remote attackers to reach internal services via the --url CLI option, exfiltrating responses into generated Python code. The vulnerability affects versions 0.9.1 through 0.60.2 when the [http] extra is installed, and can be triggered by following redirects to private networks. No public exploit activity is confirmed, but a proof-of-concept exists and the vulnerability has been patched in version 0.61.0." We need to mention EPSS and KEV: none. So "no public exploit identified at time of analysis" (since KEV is not true). But we have PoC, so "publicly available exploit code exists". The summary should incorporate that. 3. **technical_context**: Explain underlying technology, CWE-918 (SSRF), how httpx is used, http.get_body implementation, etc. Include CPE data: pip/datamodel-code-generator. Mention that the vulnerability arises from insufficient validation of URLs in the HTTP fetcher, wit
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows unauthenticated attackers who control an input XML Schema to read any file readable by the generator process, with the contents reflected into generated models. A public proof-of-concept exploit exists, and the issue is fixed in version 0.62.0.
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, references, GHSA advisory with detailed description, PoC, patch commit details, CPE. Need to produce JSON fields as instructed. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's extract key info: - Product: "datamodel-code-generator" (pip package, from koxudaxi). Product name should be 1-3 words: "datamodel-code-generator". - Description: Code injection via unescaped carriage return in `--extra-template-data` comment field, fixed in 0.60.2. - CVSS: 7.8, vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE-94: Code Injection. - Tags: Python, RCE, Code Injection, Datamodel Code Generator. - KEV: not mentioned, assume not in KEV. POC: mentioned in advisory (secret gist). But we can't confirm if it's public or private secret gist; the advisory says "Complete self contained POC is available at my secret gist", so the reporter likely privately shared with maintainers? Or the link is there? Since the GHSA description says "PoC available at my secret gist: https://...", but the URL is there. It's a public gist? Might be public. But we don't have explicit POC=YES flag. The tags don't say POC available. Advisory text includes PoC section but the URL is given. Could be public. We'll treat as "publicly available exploit code exists" since the gist URL is embedded in the advisory and likely accessible to anyone who reads it. However, we must be careful: the description says "Complete self contained POC is available at my secret gist" - "secret" might indicate private. But it's in a public security advisory, so it's exposed. It's not a standard public POC, but I'll note it as possible public POC. The instructions say: if POC=YES but no
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
Command injection in NoteGen before 0.32.0 allows remote code execution when an attacker can execute JavaScript in the application webview. The default Tauri shell plugin capability permits execution of bash, python, and python3 with arbitrary arguments, enabling the webview to run OS commands with the app's privileges, typically leading to full host compromise via cross-site scripting.
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to execute arbitrary Python code. By supplying a malicious customBasePath value containing embedded newlines and dot-free expressions, an attacker can inject code that executes when the generated module is imported. A patch is available in version 0.70.0; no public exploit is known at this time.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Path traversal in pymdown-extensions' b64 extension allows remote attackers to read arbitrary image-extension files inside the configured base_path directory by injecting '../' or absolute paths in image src attributes, leading to disclosure of file contents as base64 in rendered HTML. The vulnerability affects pymdown-extensions <=10.21.3, and a publicly available proof-of-concept exists. Exploitation requires the b64 extension to be enabled and attacker-controlled Markdown input.
We need to produce a JSON object with all fields specified. The input provides extensive details about CVE-2026-63632. Let's synthesize the data. First, we need to identify product_name: The CVE is about ONNX, specifically the Python package "onnx". The vulnerability is in the version converter of ONNX. So product_name should be "onnx" (the package). But the instruction says "1-3 words ONLY. The specific product or service name affected. ... If multiple products, pick the primary one." Here the primary product is the onnx package. So "onnx". Now summary: Should be an original synthesis, not just a paraphrase. "Remote code execution"? No, it's not RCE. It's a heap buffer overflow read, leading to information disclosure and crashes. Description says OOB read propagates leaked heap data into model output shape, potentially leaking heap data. No exploitation demonstrated beyond info leak and crash. CVSS vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low availability impact). That's local, requires user interaction, no privilege required, no confidentiality or integrity impact. So the vulnerability allows a local attacker, via a crafted model, to cause a heap buffer over-read, leading to potential information disclosure (heap data in output shape) and crashes. It's a silent leak on release builds. So summary: "Heap buffer over-read in onnx version_converter during opset downgrade of Gemm node can leak heap data or crash when processing a crafted model with undersized input tensors. Affects onnx package versions 1.3.0 to 1.21.0." Add also "publicly available exploit code exists" and EPSS? Not provided, we can't calculate EPSS. But no EPSS data in input. The summary must mention actively exploited? KEV status? Not in KEV list. So "publicly available exploit code exists" if POC available. POC/Exploit: Publicly available from the input. So "publicly available exploit code exists". Also mention "no public exploit identified at time of analysis" is not correct as POC is availa
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary commands inside the Code Interpreter sandbox by embedding shell/argument delimiters in package names passed to install_packages(). Because the CVSS vector is PR:L, an attacker needs some level of authenticated access and the flaw requires user interaction (UI:A) with a high confidentiality and integrity impact (CVSS 4.0 base 8.4). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Command injection in the Ansible Lightspeed extension for Visual Studio Code lets a crafted project achieve arbitrary code execution on a developer's machine. The extension's ansible.python.activationScript setting is treated as a shell command rather than validated as a file path, so when a victim opens or runs a malicious repository, attacker-controlled content in that setting executes with the privileges of the VS Code process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level `.mcp.json` file that the tool automatically loads via `subprocess.Popen` in `minicode/config.py`. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.
Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Python — and therefore arbitrary OS commands — with the privileges of the Langflow server process. The flaw is a design failure in the POST /api/v1/validate/code endpoint, which passes user-supplied code straight into Python's exec() with no sandbox, validation, or privilege drop. Rated CVSS 9.9 by IBM; no public exploit identified at time of analysis, though the trivial exec()-based trigger makes exploitation straightforward once authenticated.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Authentication bypass in meta-ads-mcp (< 1.0.115) lets an unauthenticated network caller send an arbitrary X-Pipeboard-Token header to slip past AuthInjectionMiddleware and execute every MCP tool using the server operator's Meta Ads credentials. The guard only rejects requests when BOTH an auth token and a pipeboard token are absent, but X-Pipeboard-Token satisfies the pipeboard branch without setting any auth context, causing the token getter to fall back to the operator's META_ACCESS_TOKEN environment variable. A publicly available exploit code exists (detailed PoC with Dockerfile and poc.py), enabling full read and write access to the operator's Meta Ads data; it affects only streamable-http deployments with META_ACCESS_TOKEN configured.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
OS command injection in django-pyas2 through version 1.2.3 lets an authenticated admin plant shell commands in the Partner model's cmd_receive and cmd_send fields, which pyas2/utils.py hands directly to os.system() when an AS2 message is processed. The submitted CVSS vector rates this 9.1 (network, unauthenticated), but the description explicitly requires an authenticated admin user, so real-world exploitability is meaningfully narrower than the headline score. EPSS is low (0.64%, 47th percentile), there is no CISA KEV listing, and a third-party vulnerability-research repository is referenced that appears to document the flaw.
Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Authentication bypass in HireFlow interview management system (versions 1.2 and earlier) lets unauthenticated remote attackers forge signed session cookies because app.py ships a hard-coded Flask secret_key. Since the key is present in the public source tree, any attacker can mint cookies asserting role=admin and arbitrary user_id values to gain full administrative access. Rated CVSS 10.0; no public exploit is identified at time of analysis, though the flaw is trivially reproducible from the disclosed source value.
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls an OpenAPI description to embed arbitrary Python that executes when a developer generates and imports the resulting client. The flaw stems from unsanitized x-ms-enum.values[].description strings being emitted as inline comments; embedded newlines break out of the comment and run at module scope. No public exploit identified at time of analysis, and the issue is not in CISA KEV. The assigned CVSS 3.1 base score is 7.5, though its impact metrics (C:N/I:N/A:H) understate what is functionally full code execution.
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker who can spoof or tamper with the Ubuntu Pro contract server response to inject arbitrary APT source lines and install malicious root-owned packages. The client builds /etc/apt/sources.list.d entries from the server's directives.suites[] and directives.aptURL fields via Python str.format() without escaping or newline filtering, and passes additionalPackages[] positionally into a root-run apt-get install. Because the component is preinstalled on supported Ubuntu Server releases and auto-attaches on cloud Ubuntu Pro images the exposure is broad; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper TLS hostname verification in the Snowflake Connector for Python (versions before 4.7.1) lets an on-path attacker defeat HTTPS certificate validation, accepting any certificate signed by any trusted CA regardless of the requested hostname. An adversary who can intercept traffic can decrypt and tamper with connector sessions, exposing Snowflake credentials, query results, and staged file data, and can inject arbitrary SQL bounded by the victim role's privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the reporting vendor (Snowflake) rates it CVSS 4.0 9.2.
Cross-user state leakage in Lookyloo's PlaywrightCapture Python library allows one capture operation to inherit sensitive data from another when multiple Capture objects run within the same Python process. Because capture-specific settings (HTTP headers, cookies, browser storage, HTTP credentials, proxy, user-agent, geolocation) were stored as mutable class-level rather than instance-level variables, a concurrent or subsequent capture in a multi-user deployment can disclose or reuse another user's authentication cookies, credentials, and captured request data. Exploitation requires low privileges (PR:L, a legitimate user of a shared deployment); a vendor patch exists (commit 1e354b9) and no public exploit identified at time of analysis.