https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T19:36:01.458171+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111058 CVE-2026-111058 — Mercury: Unauthenticated Remote Code Execution via /api/kernels 2026-10-20T19:36:01.459578+00:00

Affected: mljar mercury

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.