Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 79 available sources using the dropdown above.
| ID | Severity | Description | Package | Published | Updated |
|---|---|---|---|---|---|
| pysec-2026-1339 |
0.0 (3.1)
|
### Note On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain lev… | ethyca-fides | 2026-07-07T14:34:36.222537Z | 2026-07-07T17:24:05.465705Z |
| pysec-2026-1497 |
0.0 (3.1)
|
### Impact In previous versions of Kiwi TCMS users were able to update their email addres… | kiwitcms | 2026-07-07T11:45:18.552672Z | 2026-07-07T17:24:26.101543Z |
| pysec-2026-1924 |
0.0 (3.1)
|
### Summary The sigstore-python OAuth authentication flow is susceptible to Cross-Site R… | sigstore | 2026-07-07T16:03:20.418491Z | 2026-07-07T17:25:24.106990Z |
| pysec-2026-2480 |
0.0 (3.1)
|
### Impact This vulnerability is an improper input neutralization issue leading to outpu… | flawfinder | 2026-07-13T15:46:24.919421Z | 2026-07-13T16:04:04.844690Z |
| pysec-2026-2551 |
0.0 (3.1)
|
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were … | kiwitcms | 2026-07-13T15:46:28.995169Z | 2026-07-13T16:04:27.718301Z |
| pysec-2026-2890 |
0.6 (4.0)
|
### Summary The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extract… | poetry | 2026-07-13T15:02:52.466566Z | 2026-07-13T16:05:36.936329Z |
| pysec-2026-2042 |
1.0 (4.0)
|
### Impact It was possible to accept an invitation opened by a different Weblate user. … | weblate | 2026-07-07T16:03:12.872307Z | 2026-07-07T17:25:50.724725Z |
| pysec-2026-195 |
1.1 (4.0)
|
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data… | mlflow | 2026-06-04T12:16:24.440Z | 2026-06-05T10:22:43.284691Z |
| pysec-2026-2516 |
1.1 (4.0)
|
### Summary The "remaining charge time"-sensor for mobile phones (imported/included from … | homeassistant | 2026-07-13T14:36:45.800137Z | 2026-07-13T16:04:17.128159Z |
| pysec-2026-2517 |
1.1 (4.0)
|
### Summary An authenticated party can add a malicious name to their device entity, allow… | homeassistant | 2026-07-13T14:36:45.660731Z | 2026-07-13T16:04:17.249850Z |
| pysec-2026-3005 |
1.2 (4.0)
|
### Impact An attacker who uses this vulnerability can craft a PDF which leads to an inf… | pypdf | 2026-07-13T14:36:38.370166Z | 2026-07-13T16:05:56.007628Z |
| pysec-2026-1672 |
1.3 (4.0)
|
### Summary The GET /download/<filename> route uses string path verification via os.path.… | mobsf | 2026-07-07T16:03:03.065548Z | 2026-07-07T17:24:44.805783Z |
| pysec-2026-1104 |
1.7 (4.0)
|
### Summary The Python parser is vulnerable to a request smuggling vulnerability due to n… | aiohttp | 2026-07-07T16:02:58.017770Z | 2026-07-07T17:23:37.007122Z |
| pysec-2026-1354 |
1.8 (4.0)
|
### Impact An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 i… | exiv2 | 2026-07-07T16:03:02.528413Z | 2026-07-07T17:24:06.991981Z |
| pysec-2026-1355 |
1.8 (4.0)
|
### Impact A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm … | exiv2 | 2026-07-07T16:03:02.626933Z | 2026-07-07T17:24:07.062410Z |
| pysec-2026-1377 |
1.8 (4.0)
|
In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallb… | flask | 2026-07-07T16:02:52.410162Z | 2026-07-07T16:02:52.410162Z |
| pysec-2025-186 |
1.9 (4.0)
|
A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnera… | pywasm3 | 2025-06-19T18:15:22Z | 2026-05-21T14:54:42.578466Z |
| pysec-2026-1234 |
1.9 (4.0)
|
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers… | calibreweb | 2026-07-07T16:03:11.806566Z | 2026-07-07T17:23:52.942261Z |
| pysec-2026-1920 |
1.9 (4.0)
|
SickChill is an automatic video library manager for TV shows. A user-controlled `login` e… | sickchill | 2026-07-07T14:34:48.663290Z | 2026-07-07T17:25:23.863635Z |
| pysec-2025-190 |
2.0 (4.0)
|
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affec… | torch | 2025-03-10T13:15:36.290Z | 2026-02-24T18:52:49.347Z |
| pysec-2026-1212 |
2.0 (4.0)
|
### Impact An attacker may inject content with ASCII control characters like vertical ta… | badkeys | 2026-07-07T16:03:14.719026Z | 2026-07-07T17:23:49.361145Z |
| pysec-2026-1582 |
2.0 (4.0)
|
### Impact Non-string types are converted into string types, leading to type errors in %d… | loggingredactor | 2026-07-07T16:03:16.888713Z | 2026-07-07T17:24:35.564497Z |
| pysec-2026-1606 |
2.0 (4.0)
|
### Summary When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a … | materialx | 2026-07-07T16:02:59.437613Z | 2026-07-07T16:02:59.437613Z |
| pysec-2026-1607 |
2.0 (4.0)
|
### Summary When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a … | materialx | 2026-07-07T16:02:59.500150Z | 2026-07-07T16:02:59.500150Z |
| pysec-2026-1760 |
2.0 (4.0)
|
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attac… | pdf2zh | 2026-07-07T16:03:09.189855Z | 2026-07-07T16:03:09.189855Z |
| pysec-2026-1796 |
2.0 (4.0)
|
When pip is installing and extracting a maliciously crafted wheel archive, files may be e… | pip | 2026-07-07T16:36:56.040886Z | 2026-07-07T17:25:03.454323Z |
| pysec-2026-1913 |
2.0 (3.1)
|
### Impact Sentry's Slack integration incorrectly records the incoming request body in lo… | sentry | 2026-07-07T11:45:44.072040Z | 2026-07-07T11:45:44.072040Z |
| pysec-2026-2440 |
2.0 (4.0)
|
### Impact _What kind of vulnerability is it? Who is impacted?_ A path traversal vulnera… | dbt-common | 2026-07-13T14:36:40.777932Z | 2026-07-13T16:03:50.863034Z |
| pysec-2026-2596 |
2.0 (4.0)
|
### Summary The SQLite databases are created at predictable (static) paths in `/tmp`. Any… | linuxfabrik-lib | 2026-07-13T15:46:28.436408Z | 2026-07-13T16:04:36.177155Z |
| pysec-2026-1147 |
2.1 (4.0)
|
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue… | apache-airflow-providers-fab | 2026-07-07T14:34:48.475757Z | 2026-07-07T17:23:41.854766Z |