PyPI

RSS JSON

Thursday, October 22
- GitHub CVE-2026-96639
  Pillow multi-frame loaders can reuse stale native image storage after mode transitions
  - python-pillow Pillow
  - Critical
  - CVSS 9.8
  - EPSS 0.57%
  - Fixed version listed
  16:00 UTC
Wednesday, October 21
- GitHub CVE-2026-112393
  Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
  - python-pillow Pillow
  - Critical
  - CVSS 9.2
  - EPSS 0.53%
  - Fixed version listed
  21:28 UTC
- GitHub CVE-2026-112900
  Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
  - python-pillow Pillow
  - Critical
  - CVSS 9.2
  - EPSS 0.43%
  - Fixed version listed
  19:58 UTC
Tuesday, October 20
- GitHub CVE-2026-112403
  Pillow: Heap buffer overflow in ImagingJpegDecode
  - python-pillow Pillow
  - Critical
  - CVSS 9.2
  - EPSS 0.32%
  - Fixed version listed
  20:40 UTC
- GitHub GHSA-hq85-5cpj-mr62
  uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
  - uv (PyPI)
  - Critical
  - CVSS 9.1
  - Fixed version listed
  19:37 UTC
- GitHub GHSA-6q48-6c7w-9gw2
  certifi bundles emSign root CAs with compromised intermediate CA keys
  - certifi (PyPI)
  - Critical
  - CVSS 9.1
  - Fixed version listed
  19:35 UTC
Monday, October 19
- GitHub CVE-2026-111057
  Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
  - mljar mercury
  - Critical
  - CVSS 10.0
  - EPSS 0.44%
  - Fixed version listed
  17:00 UTC
- GitHub CVE-2026-111058
  Mercury: Unauthenticated Remote Code Execution via /api/kernels
  - mljar mercury
  - Critical
  - CVSS 9.8
  - EPSS 0.44%
  - Fixed version listed
  16:49 UTC
Friday, October 16
- GitHub CVE-2026-105192
  LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
  - LMCache LMCache
  - Critical
  - CVSS 9.8
  - EPSS 0.48%
  - Fixed version listed
  20:08 UTC
- GitHub CVE-2026-96620
  Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
  - anthropics claude-agent-sdk-python
  - Critical
  - CVSS 9.2
  - EPSS 0.58%
  - Fixed version listed
  19:44 UTC
Thursday, October 8
- GitHub CVE-2026-61447
  PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
  - MervinPraison PraisonAI
  - Critical
  - CVSS 10.0
  - EPSS 2.49%
  - Fixed version listed
  16:44 UTC
- GitHub CVE-2026-61445
  PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
  - MervinPraison PraisonAI
  - Critical
  - CVSS 9.9
  - EPSS 0.88%
  - Fixed version listed
  22:00 UTC
Wednesday, October 7
- GitHub CVE-2026-105697
  Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
  - langflow-ai langflow
  - Critical
  - CVSS 9.9
  - EPSS 0.47%
  - Fixed version listed
  20:36 UTC
- GitHub CVE-2026-62176
  PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
  - MervinPraison PraisonAI
  - Critical
  - CVSS 9.1
  - EPSS 0.46%
  - Fixed version listed
  16:05 UTC
Tuesday, October 6
- GitHub CVE-2026-10561
  Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
  - IBM Langflow OSS
  - Critical
  - CVSS 9.9
  - EPSS 0.82%
  - Fixed version listed
  13:38 UTC
Monday, October 5
- GitHub CVE-2026-8505
  Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
  - IBM Langflow OSS
  - Critical
  - CVSS 9.8
  - EPSS 0.72%
  - Fixed version listed
  22:31 UTC
- GitHub CVE-2026-9205
  Langflow: Weak Fernet Key via random.seed()
  - IBM Langflow OSS
  - Critical
  - CVSS 9.1
  - EPSS 0.3%
  - Fixed version listed
  22:31 UTC
Friday, October 2
- GitHub GHSA-v2f8-6655-7grj
  Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
  - vibe-trading-ai (PyPI)
  - Critical
  - CVSS 10.0
  - Fixed version listed
  22:44 UTC
- GitHub GHSA-jqmf-mx4f-hfr6
  Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
  - vibe-trading-ai (PyPI)
  - Critical
  - CVSS 10.0
  - Fixed version listed
  22:44 UTC
Tuesday, September 29
- GitHub CVE-2026-102268
  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
  - jpadilla pyjwt
  - Critical
  - CVSS 9.1
  - EPSS 0.2%
  - Fixed version listed
  23:17 UTC
Thursday, September 24
- GitHub CVE-2026-61732
  Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
  - BitterSecurity Decepticon
  - Critical
  - CVSS 10.0
  - EPSS 1.22%
  - Fixed version listed
  19:17 UTC
Wednesday, September 23
- GitHub CVE-2026-57149
  plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
  - plone plone.app.portlets
  - Critical
  - CVSS 9.9
  - EPSS 0.64%
  - Fixed version listed
  13:55 UTC

PyPI

Thursday, October 22

Wednesday, October 21

Tuesday, October 20

Monday, October 19

Friday, October 16

Thursday, October 8

Wednesday, October 7

Tuesday, October 6

Monday, October 5

Friday, October 2

Tuesday, September 29

Thursday, September 24

Wednesday, September 23