Python
Monthly
Remote code execution in Microsoft Semantic Kernel Python SDK before 1.39.4. Code injection in the AI orchestration framework. Patch available.
Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. [CVSS 7.0 HIGH]
Remote code execution in AutoGPT prior to version 0.6.48 allows authenticated users to execute arbitrary Python code on the backend server by embedding a disabled BlockInstallationBlock within a workflow graph, bypassing validation controls that only checked the disabled flag at direct execution endpoints. An attacker with valid credentials can exploit this to gain full control over the backend system and automate malicious workflows. The vulnerability has been patched in version 0.6.48 and all users should upgrade immediately.
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code in hooks that executes on the server. EPSS 0.28%.
Out-of-bounds write in Pillow versions 10.3.0 through 12.1.0 allows remote denial of service when processing maliciously crafted PSD image files. An attacker can trigger a crash by supplying a specially crafted image without authentication or user interaction. A patch is available in version 12.1.1.
Private-key information disclosure in the pyca/cryptography Python package (versions <= 46.0.4) arises because public-key loading and construction routines skip prime-order subgroup validation for SECT binary elliptic curves, letting an attacker submit a small-order point that leaks bits of a victim's private key during ECDH or enables signature forgery in ECDSA. Per the CVSS vector exploitation is unauthenticated and network-reachable (PR:N/AV:N) but high-complexity (AC:H), and only the rarely used SECT/binary curves are affected. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and a fix is available in 46.0.5.
Path traversal in NiceGUI before 3.7.0 allows remote attackers to write arbitrary files outside intended directories by exploiting unsanitized filename metadata in the FileUpload.name property, potentially leading to remote code execution when developers incorporate this value directly into file paths. Public exploit code exists for this vulnerability, affecting applications using common patterns like concatenating user-supplied filenames with upload directories. Developers are only protected if they use fixed paths, generate filenames server-side, or explicitly sanitize user input.
EPyT-Flow hydraulic simulation package has a CVSS 10.0 insecure deserialization enabling code execution when loading simulation scenario files.
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files outside their intended scope.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
Claude Code versions prior to 1.0.111 fail to properly validate trusted domains for WebFetch requests, allowing attackers to register lookalike domains (e.g., modelcontextprotocol.io.example.com) that bypass validation checks. This enables unauthorized automated requests to attacker-controlled servers without user interaction, potentially resulting in sensitive data exfiltration from the user's environment. The vulnerability affects Claude Code's agentic coding functionality and requires upgrading to version 1.0.111 or later to remediate.
Amazon SageMaker Python SDK versions before 3.2.0 and 2.256.0 expose the ModelBuilder HMAC signing key in cleartext API responses, allowing authenticated users with S3 bucket write access to inject malicious artifacts into training jobs that execute with elevated privileges. An attacker with dual permissions to call the DescribeTrainingJob API and modify the training output S3 location can achieve arbitrary code execution when the compromised job runs. No patch is currently available for this vulnerability.
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a contributor who can add or edit a repository's mkdocs.yml inject a malicious MkDocs `hooks` directive that runs on the TechDocs build server whenever TechDocs is configured with `runIn: local`. The flaw also affects documentation built in CI/CD via @techdocs/cli, which bundles the same package. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.8 reflects full host compromise of the build environment.
Remote code execution in AutoGPT Platform prior to v0.6.44 allows authenticated users to execute disabled blocks and write arbitrary Python code to the server filesystem. The vulnerability stems from insufficient validation of the disabled flag in block execution endpoints, enabling attackers to achieve code execution via the BlockInstallationBlock component. Public exploit code exists, and self-hosted instances with Supabase signup enabled are particularly vulnerable to account creation and exploitation.
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where inconsistent URL parsing between libraries allows attackers to bypass host restrictions and force the server to make arbitrary requests to internal network resources. Public exploit code exists for this vulnerability, which poses significant risk in containerized environments where a compromised vLLM instance could be leveraged to access restricted internal systems. The vulnerability affects users running vLLM's multimodal features with untrusted input.
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Arbitrary file write in python-multipart prior to 0.0.22 lets remote attackers place uploaded files outside the intended upload directory by supplying a filename that begins with an absolute path (e.g. '/etc/...'). The flaw only manifests in deployments that enable the non-default options UPLOAD_DIR plus UPLOAD_KEEP_FILENAME=True, where os.path.join silently discards the configured directory. Publicly available exploit code exists (Exploit-DB 52543, GHSA-wp53-j4wj-2cfg), though EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV.
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile.yaml configurations, enabling attackers to embed arbitrary files from the victim's system into bento archives during the build process. This vulnerability can be exploited to exfiltrate sensitive data such as credentials, SSH keys, and environment variables into supply chain artifacts that may be pushed to registries or deployed in production environments. A patch is available in version 1.4.34.
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Langflow's PythonFunction component allows authenticated attackers with user interaction to inject and execute arbitrary Python code within application workflows, achieving remote code execution. The vulnerability affects Langflow deployments using Python-based AI/ML components, with exploitation feasibility depending on specific product configurations. No patch is currently available.
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted custom component definitions.
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the visual AI workflow builder.
Remote code execution in Open WebUI through the load_tool_module_by_id function allows authenticated attackers to execute arbitrary Python code due to insufficient input validation on user-supplied strings. An attacker with valid credentials can leverage this vulnerability to achieve code execution with service account privileges. No patch is currently available, making this a critical risk for deployed Open WebUI instances.
MetaGPT has a code injection vulnerability in actionoutput_str_to_mapping (EPSS 2.6%) allowing remote attackers to execute arbitrary code through crafted AI agent output processing.
Grist spreadsheet software has an injection vulnerability in Python formula execution that allows authenticated users to escape the formula sandbox and execute arbitrary code.
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbitrary Python on the inference host: vLLM auto-loads Hugging Face `auto_map` dynamic modules during model resolution without honoring the `trust_remote_code` safety gate, so attacker-supplied code executes at server startup before any request is processed and without API access. The flaw carries a CVSS 9.8 and is fixed in 0.14.0, with Red Hat shipping multiple RHSA errata; however EPSS is only 0.06% (17th percentile) and there is no public exploit identified at time of analysis, so exploitation hinges on an attacker first influencing which model is loaded. This is a code-injection (CWE-94) trust-boundary bypass rather than a remotely reachable network service bug despite the AV:N rating.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
pyasn1 is a generic ASN.1 library for Python. versions up to 0.6.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpreter by getting a victim to load a malicious .keras model archive. The crafted archive embeds a valid model.weights.h5 HDF5 file whose dataset declares an enormously large shape, so the weight loader attempts to allocate unbounded memory during deserialization. There is no public exploit identified at time of analysis, EPSS risk is low (0.03%), and a vendor fix is available.
Remote code execution in Azure Core Shared Client Library for Python results from insecure deserialization of untrusted data, allowing authenticated network-based attackers to achieve arbitrary code execution. The vulnerability affects Python applications utilizing the vulnerable library versions, with no patch currently available. This represents a high-severity risk for Azure SDK consumers handling external or user-supplied serialized data.
Fickling versions prior to 0.1.7 fail to properly detect malicious pickle payloads due to inadequate handling of the "builtins" module, allowing attackers to bypass security analysis and potentially execute arbitrary code. This vulnerability affects Python environments using vulnerable versions of Fickling for pickle inspection and static analysis. An attacker can craft specially designed pickle files that evade detection mechanisms, compromising the integrity of pickle validation workflows.
Fickling's static analyzer before version 0.1.7 fails to detect several dangerous Python modules in pickled objects, enabling attackers to craft malicious pickles that bypass safety checks and achieve arbitrary code execution. This vulnerability affects users relying on Fickling to validate untrusted serialized Python objects for safety. Public exploit code exists for this HIGH severity vulnerability, though a patch is available in version 0.1.7 and later.
Fickling before version 0.1.7 allows local attackers to achieve arbitrary code execution through Python pickle deserialization by chaining unblocked ctypes and pydoc modules, bypassing the tool's safety scanner which incorrectly reports malicious files as LIKELY_SAFE. An attacker with user interaction can exploit this vulnerability to execute code with the privileges of the Python process. A patch is available in version 0.1.7 and later.
Fickling's static analyzer through version 0.1.6 fails to properly classify the cProfile module as unsafe during pickle analysis, causing malicious pickles leveraging cProfile.run() to be marked as SUSPICIOUS rather than OVERTLY_MALICIOUS. Organizations using Fickling as a security gate for deserialization decisions may be deceived into executing attacker-controlled code. Public exploit code exists for this vulnerability, and patches are available in version 0.1.7 and later.
Fickling's incomplete pickle analysis allows attackers to bypass security checks by using Python's runpy module to execute arbitrary code. Versions through 0.1.6 misclassify dangerous runpy-based payloads as merely suspicious rather than malicious, enabling code execution on systems that rely on Fickling to validate pickle safety. Public exploit code exists for this vulnerability, though a patch is available in version 0.1.7.
NiceGUI versions 2.22.0 through 3.4.1 contain a cross-site DOM-based XSS vulnerability in the pushstate event listener for ui.sub_pages that allows attackers to manipulate URL fragment identifiers via iframe injection. Public exploit code exists for this vulnerability, and affected users should upgrade to version 3.5.0 or later as no patch is currently available for vulnerable versions.
Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicious or compromised server crash or exhaust memory on the client by serving a compressed redirect response. When an application streams from an untrusted source with preload_content=False and has not disabled redirects, urllib3 eagerly drains and decompresses the entire redirect body before any read call, ignoring configured read limits, leaving no defense against decompression bombs. EPSS is low (0.03%), there is no public exploit identified at time of analysis, and it is not in CISA KEV, but the bug is broadly reachable given urllib3's ubiquity.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.3%.
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 48.7%.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
Missing authorization in the Django-CRM bulk case update endpoint (backend/cases/bulk_views.py) allows any authenticated member of an organization to edit, reassign, or close cases belonging to other users. Affected releases are django-crm 1.0 through 1.2; the same code path also skips the model's close-transition validation, so a case can be closed without the recorded approval that the single-case workflow requires. Version 1.3.0 resolves the issue (patch commit 799bb121), CVSS 4.0 rates it 5.3 (AV:N/AC:L/PR:L/UI:N), SSVC records no exploitation and no automatable vector, and no public exploit code has been identified at time of analysis.
Let me synthesize the analysis for CVE-2026-90790, an SSRF in a2a-python's push notification sender. Key facts: - Product: a2a-python (A2A Python SDK by a2aproject) - Function: _dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py - Component: Push Notification Sender - Argument push_info.url → SSRF (CWE-918) - Remote exploitation possible - Affected: up to 1.1.3 (1.1.0, 1.1.1, 1.1.2, 1.1.3) - Fix: 1.1.4 (release tag v1.1.4, PRs 1164 and 1169) - CVSS 4.0: 5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Note PR:L — low privileges required. So authenticated in some sense. - EPSS: not provided - KEV: no - POC: "Reported by VulDB" — no explicit POC. The patch PRs are public, so the fix commit is public. But no explicit POC listed. I'll say "no public exploit identified at time of analysis". - Tags: Python, SSRF, A2A Python Patch: available from vendor, exact version 1.1.4. Interesting detail from diff: the library removed the built-in `push_url_validation_error` helper (SSRF screening) and made the validator opt-in, requiring the deployment to pass `push_url_validator` explicitly. Actually the diff shows the removal of `_ip_is_blocked` and `push_url_validation_error` from base_push_notification_sender.py, and adding a push_url_validator parameter that defaults to None (no library screening). Hmm — that's interesting: the fix in v1.1.4 removed the automatic SSRF screening and replaced it with opt-in validation via `validate_push_notification_url` in src/a2a/utils/push_url_validator.py. That's a bit odd — the fix may be reworked. Actually it looks like the "fix" makes the URL validation a shared utility and requires explicit opt-in. Hmm, this suggests the vulnerability was that the default screening wasn't applied in `_dispatch_notification` at all (the function didn't call the validator), so pushing to a malicious URL would trigger an outbound request to an arbitrary internal address. The PR adds the validator hook into `_dispat
NoSQL injection in the GridFS component of the MongoDB Python Driver allows an authenticated attacker who controls a caller-supplied file identifier to inject MongoDB query operators instead of literal identifiers. Depending on the affected operation, exploitation can expose stored file content beyond the intended target (reads), permanently destroy all GridFS file chunks in the affected bucket (deletes), or corrupt stored file metadata by renaming the wrong file (renames). No public exploit has been identified at time of analysis, and no KEV listing exists; the CVSS 4.0 score of 6.1 reflects the authentication requirement and the specific attack condition that the application must pass user-controlled identifiers directly to GridFS APIs.
WeasyPrint ≤v69.0 silently bypasses application-configured url_fetcher restrictions in two write_pdf() channels, enabling arbitrary local file read and SSRF in server-side PDF rendering pipelines. The xmp_metadata parameter fetches attacker-controlled URLs using the default unrestricted URLFetcher and embeds the response bytes verbatim in the generated PDF, while the stylesheets parameter applies fetched CSS with transitive propagation through @import chains - both ignoring any restrictive fetcher set on HTML(). No public exploit is listed in KEV, but the advisory includes complete working PoC code demonstrating credential file exfiltration.
Path traversal in GitHacker ≤1.1.7 allows a malicious git server to coerce the tool into reading arbitrary files from the victim's local filesystem via an unsanitized `ref:` value in a crafted `.git/HEAD`. The exploitable primitive is narrower than full arbitrary file-read: the recovery loop converts every 40-character hex substring in any accessed file into an outbound HTTP GET back to the attacker's server, yielding an existence oracle for arbitrary paths and hex-fragment exfiltration for files containing cryptographic material such as password hashes, HMAC-SHA1 outputs, or SSH key fingerprints. Exploitation requires the victim to actively run GitHacker against an attacker-controlled URL; no public exploit code has been identified at time of analysis, and a vendor-released patch is available as version 1.1.8.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request._prepare() in _models.py appends a Content-Length header even when a caller-supplied Transfer-Encoding header is already present, producing HTTP/1.1 requests with two conflicting framing headers simultaneously. Downstream intermediaries such as reverse proxies or API gateways that resolve the Content-Length vs. Transfer-Encoding ambiguity differently from the upstream server can misparse request boundaries, enabling request smuggling or connection desynchronization affecting co-located sessions. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in v2.11.0.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny service to Python applications using httpx2.Client.sse() or httpx2.AsyncClient.sse() in versions 2.5.0 through 2.9.x. The _SSELineDecoder.decode() method in _sse.py repeatedly copies and rescans its entire in-memory buffer each time a new chunk arrives for an unterminated line, producing O(n²) processing work proportional to the length of the crafted line. A crafted stream can consume excessive CPU, blocking a synchronous worker thread indefinitely or starving an asynchronous event loop. No public exploit identified at time of analysis; a vendor-released patch is available in version 2.10.0.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Resource exhaustion in pypdf prior to 6.16.1 allows an attacker who can supply a crafted PDF to cause denial of service by triggering unbounded traversal in `_get_outline` within `pypdf/_doc_common.py`. Any application that processes untrusted PDF files and accesses document outlines is exposed - the traversal lacked global entry-count and nesting-depth limits, enabling crafted PDFs with large numbers of bookmark entries or deeply nested reused paths to consume excessive CPU and memory. No public exploit has been identified at time of analysis, and a patched release (6.16.1) is available.
Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-based write pipeline to permanently hang the processing worker. The root cause is in TreeObject.insert_child within pypdf/generic/_data_structures.py, which traverses /Next links without cycle detection; a PDF whose tree nodes form a circular reference (A→B→C→A) causes unbounded traversal. No public exploitation has been confirmed and no CISA KEV entry exists, but a functional proof-of-concept is embedded in the upstream fix PR (#3964).
Quadratic CPU exhaustion in sqlparse's reindentation path allows denial of service against any Python application that passes attacker-controlled SQL to sqlparse.format() with reindent=True. The ReindentFilter._get_offset() method formerly rebuilt the full statement prefix from the token tree's root on every call, resulting in O(N²) CPU growth when processing parenthesized tuple lists - such as large IN (...) or INSERT INTO ... VALUES (...) expressions. A ~12 KB crafted SQL payload can pin a CPU worker for seconds, enabling request delays, throughput reduction, or worker starvation in any service that exposes this formatting path. No public exploit has been identified at time of analysis, and the fix is available in sqlparse 0.6.0.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
Out-of-bounds read in Exiv2's RemoteIo::Impl::populateBlocks() function affects versions prior to 0.28.9, exploitable only when the tool is invoked against a remote URL rather than a local file. An attacker controlling a remote server can serve a crafted image to trigger the read when a user runs exiv2 against that URL, potentially causing information disclosure or a crash. No public exploit code or active exploitation has been identified; the vulnerability is rated low severity and fixed in the 0.28.9 release.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Starlette-Admin, the Python ASGI-based administrative UI framework, fails to validate sort and filter parameters against configured field allowlists on its backend API, allowing any authenticated user to bypass the frontend field restrictions and query hidden or non-sortable columns as an information-disclosure oracle. Additionally, passing special Python attribute names such as `__class__` or `metadata` as field values triggers unhandled exceptions that return HTTP 500 responses, creating a limited denial-of-service condition against targeted list endpoints. All versions prior to 0.16.1 are affected; no public exploit code has been identified and this vulnerability is not in CISA KEV.
Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.
PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.
Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.
Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Cache isolation failure in django CMS allows unauthenticated network attackers to both read other users' header-personalized page content and poison the page cache with attacker-chosen content. Affected installations must have CMS_PAGE_CACHE enabled and at least one plugin implementing get_vary_cache_on() - when those conditions hold, the page cache key is computed without the plugin-declared header values, so the first cached variant is served to all subsequent visitors regardless of their headers. No public exploit exists and CISA KEV has not listed this vulnerability, but the attack is mechanically straightforward in affected configurations.
Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.
Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.
Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.
Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.
Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.
Pyenv's version-selection shell scripts silently redirect Python interpreter selection to an unintended installed version when the PYENV_VERSION or .python-version value contains shell glob metacharacters and a matching file exists in the working directory. All seven libexec scripts (pyenv-version-name, pyenv-which, pyenv-prefix, pyenv-local, pyenv-global, pyenv-version, pyenv-versions) expand the version string without disabling glob expansion via set -f, allowing pathname expansion against the current directory's contents. The fix in v2.8.0 adds set -f/set +f guards around all affected expansions. No public exploit identified at time of analysis; the CVSS 4.0 score of 2.0 with AT:P reflects the constrained exploitation conditions.
Stored XSS in the Pandora malware analysis platform's PDF download endpoint allows attacker-controlled JavaScript to execute in the security context of the application when an analyst views a crafted analysis task. An attacker submits a polyglot file that passes Pandora's content-based PDF detection but whose filename or extension causes Flask's send_file() to serve it with an active MIME type such as text/html, with no Content-Disposition: attachment header forcing browser download. Any victim with access to the analysis task who follows the PDF download link will have attacker-supplied script execute in their Pandora session, potentially exposing session data or enabling unauthorized actions. No public exploit identified at time of analysis; a patch is available via upstream commit 668ec65a93cee327e3d925da2698849c9e65625a.
Remote code execution in Microsoft Semantic Kernel Python SDK before 1.39.4. Code injection in the AI orchestration framework. Patch available.
Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. [CVSS 7.0 HIGH]
Remote code execution in AutoGPT prior to version 0.6.48 allows authenticated users to execute arbitrary Python code on the backend server by embedding a disabled BlockInstallationBlock within a workflow graph, bypassing validation controls that only checked the disabled flag at direct execution endpoints. An attacker with valid credentials can exploit this to gain full control over the backend system and automate malicious workflows. The vulnerability has been patched in version 0.6.48 and all users should upgrade immediately.
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code in hooks that executes on the server. EPSS 0.28%.
Out-of-bounds write in Pillow versions 10.3.0 through 12.1.0 allows remote denial of service when processing maliciously crafted PSD image files. An attacker can trigger a crash by supplying a specially crafted image without authentication or user interaction. A patch is available in version 12.1.1.
Private-key information disclosure in the pyca/cryptography Python package (versions <= 46.0.4) arises because public-key loading and construction routines skip prime-order subgroup validation for SECT binary elliptic curves, letting an attacker submit a small-order point that leaks bits of a victim's private key during ECDH or enables signature forgery in ECDSA. Per the CVSS vector exploitation is unauthenticated and network-reachable (PR:N/AV:N) but high-complexity (AC:H), and only the rarely used SECT/binary curves are affected. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and a fix is available in 46.0.5.
Path traversal in NiceGUI before 3.7.0 allows remote attackers to write arbitrary files outside intended directories by exploiting unsanitized filename metadata in the FileUpload.name property, potentially leading to remote code execution when developers incorporate this value directly into file paths. Public exploit code exists for this vulnerability, affecting applications using common patterns like concatenating user-supplied filenames with upload directories. Developers are only protected if they use fixed paths, generate filenames server-side, or explicitly sanitize user input.
EPyT-Flow hydraulic simulation package has a CVSS 10.0 insecure deserialization enabling code execution when loading simulation scenario files.
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files outside their intended scope.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.
Claude Code versions prior to 1.0.111 fail to properly validate trusted domains for WebFetch requests, allowing attackers to register lookalike domains (e.g., modelcontextprotocol.io.example.com) that bypass validation checks. This enables unauthorized automated requests to attacker-controlled servers without user interaction, potentially resulting in sensitive data exfiltration from the user's environment. The vulnerability affects Claude Code's agentic coding functionality and requires upgrading to version 1.0.111 or later to remediate.
Amazon SageMaker Python SDK versions before 3.2.0 and 2.256.0 expose the ModelBuilder HMAC signing key in cleartext API responses, allowing authenticated users with S3 bucket write access to inject malicious artifacts into training jobs that execute with elevated privileges. An attacker with dual permissions to call the DescribeTrainingJob API and modify the training output S3 location can achieve arbitrary code execution when the compromised job runs. No patch is currently available for this vulnerability.
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a contributor who can add or edit a repository's mkdocs.yml inject a malicious MkDocs `hooks` directive that runs on the TechDocs build server whenever TechDocs is configured with `runIn: local`. The flaw also affects documentation built in CI/CD via @techdocs/cli, which bundles the same package. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.8 reflects full host compromise of the build environment.
Remote code execution in AutoGPT Platform prior to v0.6.44 allows authenticated users to execute disabled blocks and write arbitrary Python code to the server filesystem. The vulnerability stems from insufficient validation of the disabled flag in block execution endpoints, enabling attackers to achieve code execution via the BlockInstallationBlock component. Public exploit code exists, and self-hosted instances with Supabase signup enabled are particularly vulnerable to account creation and exploitation.
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where inconsistent URL parsing between libraries allows attackers to bypass host restrictions and force the server to make arbitrary requests to internal network resources. Public exploit code exists for this vulnerability, which poses significant risk in containerized environments where a compromised vLLM instance could be leveraged to access restricted internal systems. The vulnerability affects users running vLLM's multimodal features with untrusted input.
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Arbitrary file write in python-multipart prior to 0.0.22 lets remote attackers place uploaded files outside the intended upload directory by supplying a filename that begins with an absolute path (e.g. '/etc/...'). The flaw only manifests in deployments that enable the non-default options UPLOAD_DIR plus UPLOAD_KEEP_FILENAME=True, where os.path.join silently discards the configured directory. Publicly available exploit code exists (Exploit-DB 52543, GHSA-wp53-j4wj-2cfg), though EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV.
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile.yaml configurations, enabling attackers to embed arbitrary files from the victim's system into bento archives during the build process. This vulnerability can be exploited to exfiltrate sensitive data such as credentials, SSH keys, and environment variables into supply chain artifacts that may be pushed to registries or deployed in production environments. A patch is available in version 1.4.34.
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Langflow's PythonFunction component allows authenticated attackers with user interaction to inject and execute arbitrary Python code within application workflows, achieving remote code execution. The vulnerability affects Langflow deployments using Python-based AI/ML components, with exploitation feasibility depending on specific product configurations. No patch is currently available.
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted custom component definitions.
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the visual AI workflow builder.
Remote code execution in Open WebUI through the load_tool_module_by_id function allows authenticated attackers to execute arbitrary Python code due to insufficient input validation on user-supplied strings. An attacker with valid credentials can leverage this vulnerability to achieve code execution with service account privileges. No patch is currently available, making this a critical risk for deployed Open WebUI instances.
MetaGPT has a code injection vulnerability in actionoutput_str_to_mapping (EPSS 2.6%) allowing remote attackers to execute arbitrary code through crafted AI agent output processing.
Grist spreadsheet software has an injection vulnerability in Python formula execution that allows authenticated users to escape the formula sandbox and execute arbitrary code.
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbitrary Python on the inference host: vLLM auto-loads Hugging Face `auto_map` dynamic modules during model resolution without honoring the `trust_remote_code` safety gate, so attacker-supplied code executes at server startup before any request is processed and without API access. The flaw carries a CVSS 9.8 and is fixed in 0.14.0, with Red Hat shipping multiple RHSA errata; however EPSS is only 0.06% (17th percentile) and there is no public exploit identified at time of analysis, so exploitation hinges on an attacker first influencing which model is loaded. This is a code-injection (CWE-94) trust-boundary bypass rather than a remotely reachable network service bug despite the AV:N rating.
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox restrictions and execute arbitrary code on the underlying operating system, with full instance takeover possible in Internal execution mode. Public exploit code exists for this vulnerability, which affects n8n deployments running under Internal execution mode where the Python executor has direct OS access. External execution mode deployments using Docker sidecars have reduced impact as code execution is confined to the container rather than the main node.
pyasn1 is a generic ASN.1 library for Python. versions up to 0.6.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpreter by getting a victim to load a malicious .keras model archive. The crafted archive embeds a valid model.weights.h5 HDF5 file whose dataset declares an enormously large shape, so the weight loader attempts to allocate unbounded memory during deserialization. There is no public exploit identified at time of analysis, EPSS risk is low (0.03%), and a vendor fix is available.
Remote code execution in Azure Core Shared Client Library for Python results from insecure deserialization of untrusted data, allowing authenticated network-based attackers to achieve arbitrary code execution. The vulnerability affects Python applications utilizing the vulnerable library versions, with no patch currently available. This represents a high-severity risk for Azure SDK consumers handling external or user-supplied serialized data.
Fickling versions prior to 0.1.7 fail to properly detect malicious pickle payloads due to inadequate handling of the "builtins" module, allowing attackers to bypass security analysis and potentially execute arbitrary code. This vulnerability affects Python environments using vulnerable versions of Fickling for pickle inspection and static analysis. An attacker can craft specially designed pickle files that evade detection mechanisms, compromising the integrity of pickle validation workflows.
Fickling's static analyzer before version 0.1.7 fails to detect several dangerous Python modules in pickled objects, enabling attackers to craft malicious pickles that bypass safety checks and achieve arbitrary code execution. This vulnerability affects users relying on Fickling to validate untrusted serialized Python objects for safety. Public exploit code exists for this HIGH severity vulnerability, though a patch is available in version 0.1.7 and later.
Fickling before version 0.1.7 allows local attackers to achieve arbitrary code execution through Python pickle deserialization by chaining unblocked ctypes and pydoc modules, bypassing the tool's safety scanner which incorrectly reports malicious files as LIKELY_SAFE. An attacker with user interaction can exploit this vulnerability to execute code with the privileges of the Python process. A patch is available in version 0.1.7 and later.
Fickling's static analyzer through version 0.1.6 fails to properly classify the cProfile module as unsafe during pickle analysis, causing malicious pickles leveraging cProfile.run() to be marked as SUSPICIOUS rather than OVERTLY_MALICIOUS. Organizations using Fickling as a security gate for deserialization decisions may be deceived into executing attacker-controlled code. Public exploit code exists for this vulnerability, and patches are available in version 0.1.7 and later.
Fickling's incomplete pickle analysis allows attackers to bypass security checks by using Python's runpy module to execute arbitrary code. Versions through 0.1.6 misclassify dangerous runpy-based payloads as merely suspicious rather than malicious, enabling code execution on systems that rely on Fickling to validate pickle safety. Public exploit code exists for this vulnerability, though a patch is available in version 0.1.7.
NiceGUI versions 2.22.0 through 3.4.1 contain a cross-site DOM-based XSS vulnerability in the pushstate event listener for ui.sub_pages that allows attackers to manipulate URL fragment identifiers via iframe injection. Public exploit code exists for this vulnerability, and affected users should upgrade to version 3.5.0 or later as no patch is currently available for vulnerable versions.
Uncontrolled resource consumption in the Python urllib3 HTTP client library (versions 1.22 through 2.6.2) lets a malicious or compromised server crash or exhaust memory on the client by serving a compressed redirect response. When an application streams from an untrusted source with preload_content=False and has not disabled redirects, urllib3 eagerly drains and decompresses the entire redirect body before any read call, ignoring configured read limits, leaving no defense against decompression bombs. EPSS is low (0.03%), there is no public exploit identified at time of analysis, and it is not in CISA KEV, but the bug is broadly reachable given urllib3's ubiquity.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.3%.
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 48.7%.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
Missing authorization in the Django-CRM bulk case update endpoint (backend/cases/bulk_views.py) allows any authenticated member of an organization to edit, reassign, or close cases belonging to other users. Affected releases are django-crm 1.0 through 1.2; the same code path also skips the model's close-transition validation, so a case can be closed without the recorded approval that the single-case workflow requires. Version 1.3.0 resolves the issue (patch commit 799bb121), CVSS 4.0 rates it 5.3 (AV:N/AC:L/PR:L/UI:N), SSVC records no exploitation and no automatable vector, and no public exploit code has been identified at time of analysis.
Let me synthesize the analysis for CVE-2026-90790, an SSRF in a2a-python's push notification sender. Key facts: - Product: a2a-python (A2A Python SDK by a2aproject) - Function: _dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py - Component: Push Notification Sender - Argument push_info.url → SSRF (CWE-918) - Remote exploitation possible - Affected: up to 1.1.3 (1.1.0, 1.1.1, 1.1.2, 1.1.3) - Fix: 1.1.4 (release tag v1.1.4, PRs 1164 and 1169) - CVSS 4.0: 5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Note PR:L — low privileges required. So authenticated in some sense. - EPSS: not provided - KEV: no - POC: "Reported by VulDB" — no explicit POC. The patch PRs are public, so the fix commit is public. But no explicit POC listed. I'll say "no public exploit identified at time of analysis". - Tags: Python, SSRF, A2A Python Patch: available from vendor, exact version 1.1.4. Interesting detail from diff: the library removed the built-in `push_url_validation_error` helper (SSRF screening) and made the validator opt-in, requiring the deployment to pass `push_url_validator` explicitly. Actually the diff shows the removal of `_ip_is_blocked` and `push_url_validation_error` from base_push_notification_sender.py, and adding a push_url_validator parameter that defaults to None (no library screening). Hmm — that's interesting: the fix in v1.1.4 removed the automatic SSRF screening and replaced it with opt-in validation via `validate_push_notification_url` in src/a2a/utils/push_url_validator.py. That's a bit odd — the fix may be reworked. Actually it looks like the "fix" makes the URL validation a shared utility and requires explicit opt-in. Hmm, this suggests the vulnerability was that the default screening wasn't applied in `_dispatch_notification` at all (the function didn't call the validator), so pushing to a malicious URL would trigger an outbound request to an arbitrary internal address. The PR adds the validator hook into `_dispat
NoSQL injection in the GridFS component of the MongoDB Python Driver allows an authenticated attacker who controls a caller-supplied file identifier to inject MongoDB query operators instead of literal identifiers. Depending on the affected operation, exploitation can expose stored file content beyond the intended target (reads), permanently destroy all GridFS file chunks in the affected bucket (deletes), or corrupt stored file metadata by renaming the wrong file (renames). No public exploit has been identified at time of analysis, and no KEV listing exists; the CVSS 4.0 score of 6.1 reflects the authentication requirement and the specific attack condition that the application must pass user-controlled identifiers directly to GridFS APIs.
WeasyPrint ≤v69.0 silently bypasses application-configured url_fetcher restrictions in two write_pdf() channels, enabling arbitrary local file read and SSRF in server-side PDF rendering pipelines. The xmp_metadata parameter fetches attacker-controlled URLs using the default unrestricted URLFetcher and embeds the response bytes verbatim in the generated PDF, while the stylesheets parameter applies fetched CSS with transitive propagation through @import chains - both ignoring any restrictive fetcher set on HTML(). No public exploit is listed in KEV, but the advisory includes complete working PoC code demonstrating credential file exfiltration.
Path traversal in GitHacker ≤1.1.7 allows a malicious git server to coerce the tool into reading arbitrary files from the victim's local filesystem via an unsanitized `ref:` value in a crafted `.git/HEAD`. The exploitable primitive is narrower than full arbitrary file-read: the recovery loop converts every 40-character hex substring in any accessed file into an outbound HTTP GET back to the attacker's server, yielding an existence oracle for arbitrary paths and hex-fragment exfiltration for files containing cryptographic material such as password hashes, HMAC-SHA1 outputs, or SSH key fingerprints. Exploitation requires the victim to actively run GitHacker against an attacker-controlled URL; no public exploit code has been identified at time of analysis, and a vendor-released patch is available as version 1.1.8.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request._prepare() in _models.py appends a Content-Length header even when a caller-supplied Transfer-Encoding header is already present, producing HTTP/1.1 requests with two conflicting framing headers simultaneously. Downstream intermediaries such as reverse proxies or API gateways that resolve the Content-Length vs. Transfer-Encoding ambiguity differently from the upstream server can misparse request boundaries, enabling request smuggling or connection desynchronization affecting co-located sessions. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in v2.11.0.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny service to Python applications using httpx2.Client.sse() or httpx2.AsyncClient.sse() in versions 2.5.0 through 2.9.x. The _SSELineDecoder.decode() method in _sse.py repeatedly copies and rescans its entire in-memory buffer each time a new chunk arrives for an unterminated line, producing O(n²) processing work proportional to the length of the crafted line. A crafted stream can consume excessive CPU, blocking a synchronous worker thread indefinitely or starving an asynchronous event loop. No public exploit identified at time of analysis; a vendor-released patch is available in version 2.10.0.
Jenkins REST API in versions 2.579 and earlier (LTS 2.568.2 and earlier) fails to escape map keys during JSON and Python serialization, enabling authenticated users who can control map property names to inject arbitrary fields into API responses consumed by downstream tooling or users. The flaw (CWE-116, improper output encoding) is rated CVSS 4.3 Medium with integrity-only impact and requires low-privilege authenticated access. No public exploit code or CISA KEV listing has been identified; vendor patches 2.580 and LTS 2.568.3 were released on 2026-09-02.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Resource exhaustion in pypdf prior to 6.16.1 allows an attacker who can supply a crafted PDF to cause denial of service by triggering unbounded traversal in `_get_outline` within `pypdf/_doc_common.py`. Any application that processes untrusted PDF files and accesses document outlines is exposed - the traversal lacked global entry-count and nesting-depth limits, enabling crafted PDFs with large numbers of bookmark entries or deeply nested reused paths to consume excessive CPU and memory. No public exploit has been identified at time of analysis, and a patched release (6.16.1) is available.
Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-based write pipeline to permanently hang the processing worker. The root cause is in TreeObject.insert_child within pypdf/generic/_data_structures.py, which traverses /Next links without cycle detection; a PDF whose tree nodes form a circular reference (A→B→C→A) causes unbounded traversal. No public exploitation has been confirmed and no CISA KEV entry exists, but a functional proof-of-concept is embedded in the upstream fix PR (#3964).
Quadratic CPU exhaustion in sqlparse's reindentation path allows denial of service against any Python application that passes attacker-controlled SQL to sqlparse.format() with reindent=True. The ReindentFilter._get_offset() method formerly rebuilt the full statement prefix from the token tree's root on every call, resulting in O(N²) CPU growth when processing parenthesized tuple lists - such as large IN (...) or INSERT INTO ... VALUES (...) expressions. A ~12 KB crafted SQL payload can pin a CPU worker for seconds, enabling request delays, throughput reduction, or worker starvation in any service that exposes this formatting path. No public exploit has been identified at time of analysis, and the fix is available in sqlparse 0.6.0.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
Out-of-bounds read in Exiv2's RemoteIo::Impl::populateBlocks() function affects versions prior to 0.28.9, exploitable only when the tool is invoked against a remote URL rather than a local file. An attacker controlling a remote server can serve a crafted image to trigger the read when a user runs exiv2 against that URL, potentially causing information disclosure or a crash. No public exploit code or active exploitation has been identified; the vulnerability is rated low severity and fixed in the 0.28.9 release.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Starlette-Admin, the Python ASGI-based administrative UI framework, fails to validate sort and filter parameters against configured field allowlists on its backend API, allowing any authenticated user to bypass the frontend field restrictions and query hidden or non-sortable columns as an information-disclosure oracle. Additionally, passing special Python attribute names such as `__class__` or `metadata` as field values triggers unhandled exceptions that return HTTP 500 responses, creating a limited denial-of-service condition against targeted list endpoints. All versions prior to 0.16.1 are affected; no public exploit code has been identified and this vulnerability is not in CISA KEV.
Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.
PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.
Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.
Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Cache isolation failure in django CMS allows unauthenticated network attackers to both read other users' header-personalized page content and poison the page cache with attacker-chosen content. Affected installations must have CMS_PAGE_CACHE enabled and at least one plugin implementing get_vary_cache_on() - when those conditions hold, the page cache key is computed without the plugin-declared header values, so the first cached variant is served to all subsequent visitors regardless of their headers. No public exploit exists and CISA KEV has not listed this vulnerability, but the attack is mechanically straightforward in affected configurations.
Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.
Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.
Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.
Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.
Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.
Pyenv's version-selection shell scripts silently redirect Python interpreter selection to an unintended installed version when the PYENV_VERSION or .python-version value contains shell glob metacharacters and a matching file exists in the working directory. All seven libexec scripts (pyenv-version-name, pyenv-which, pyenv-prefix, pyenv-local, pyenv-global, pyenv-version, pyenv-versions) expand the version string without disabling glob expansion via set -f, allowing pathname expansion against the current directory's contents. The fix in v2.8.0 adds set -f/set +f guards around all affected expansions. No public exploit identified at time of analysis; the CVSS 4.0 score of 2.0 with AT:P reflects the constrained exploitation conditions.
Stored XSS in the Pandora malware analysis platform's PDF download endpoint allows attacker-controlled JavaScript to execute in the security context of the application when an analyst views a crafted analysis task. An attacker submits a polyglot file that passes Pandora's content-based PDF detection but whose filename or extension causes Flask's send_file() to serve it with an active MIME type such as text/html, with no Content-Disposition: attachment header forcing browser download. Any victim with access to the analysis task who follows the PDF download link will have attacker-supplied script execute in their Pandora session, potentially exposing session data or enabling unauthorized actions. No public exploit identified at time of analysis; a patch is available via upstream commit 668ec65a93cee327e3d925da2698849c9e65625a.