Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 79 available sources using the dropdown above.
| ID | Severity | Description | Package | Published | Updated |
|---|---|---|---|---|---|
| pysec-2025-19 |
9.8 (3.1)
|
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for … | picklescan | 2025-03-03T19:15:34+00:00 | 2027-07-09T15:54:00+00:00 |
| pysec-2024-115 |
9.8 (3.1)
|
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community versi… | langchain-community | 2024-11-05T16:04:14Z | 2027-07-09T15:45:00Z |
| pysec-2026-3720 |
3.1 (3.1)
|
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside … | bbot | 2026-07-08T16:16:27.373Z | 2026-08-20T11:24:27.000200Z |
| pysec-2026-3719 |
3.1 (3.1)
|
BBOT's unarchive module rejects archives containing symlink entries before extraction, bu… | bbot | 2026-07-08T16:16:27.237Z | 2026-08-20T11:24:26.193694Z |
| pysec-2026-3718 |
8.7 (4.0)
|
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing S… | surrealdb | 2026-07-18T14:17:07.603Z | 2026-08-19T13:09:23.908994Z |
| pysec-2026-3717 |
6.9 (4.0)
|
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `dj… | django | 2026-08-04T17:16:46.593Z | 2026-08-19T13:09:07.315989Z |
| pysec-2026-3716 |
6.9 (4.0)
|
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability … | datasets | 2026-07-24T15:19:07.493Z | 2026-08-19T13:09:06.119873Z |
| pysec-2026-3712 |
6.5 (3.1)
|
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a l… | apache-airflow | 2026-08-12T16:17:19.853Z | 2026-08-19T13:09:03.428120Z |
| pysec-2026-3711 |
6.5 (3.1)
|
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in … | apache-airflow | 2026-08-12T16:17:19.730Z | 2026-08-19T13:09:03.353352Z |
| pysec-2026-3710 |
7.5 (3.1)
|
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the calle… | apache-airflow | 2026-08-12T16:17:19.607Z | 2026-08-19T13:09:03.278008Z |
| pysec-2026-3709 |
5.4 (3.1)
|
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection o… | apache-airflow | 2026-08-12T16:17:15.223Z | 2026-08-19T13:09:03.207169Z |
| pysec-2026-3708 |
8.8 (3.1)
|
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running … | apache-airflow | 2026-08-12T16:17:15.090Z | 2026-08-19T13:09:03.140566Z |
| pysec-2026-3707 |
7.3 (3.1)
|
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_… | apache-airflow | 2026-08-12T16:17:14.813Z | 2026-08-19T13:09:03.078176Z |
| pysec-2026-3706 |
6.5 (3.1)
|
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a … | apache-airflow | 2026-08-12T16:17:09.197Z | 2026-08-19T13:09:03.009025Z |
| pysec-2026-3705 |
4.3 (3.1)
|
Apache Airflow's secrets masker hides values stored under sensitive key names when they a… | apache-airflow | 2026-08-12T16:17:04.640Z | 2026-08-19T13:09:02.937435Z |
| pysec-2026-3715 |
6.5 (3.1)
|
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-sc… | apache-airflow-providers-yandex | 2026-08-10T19:17:30.463Z | 2026-08-19T13:09:02.635411Z |
| pysec-2026-3714 |
6.5 (3.1)
|
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never… | apache-airflow-providers-google | 2026-08-12T11:17:10.063Z | 2026-08-19T13:09:02.511247Z |
| pysec-2026-3713 |
6.5 (3.1)
|
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's … | apache-airflow-providers-amazon | 2026-08-10T19:17:30.587Z | 2026-08-19T13:09:02.440892Z |
| pysec-2026-3704 |
6.5 (3.1)
|
## Summary The `/v1/completions` request model accepts `prompt` as a list of text prompt… | vllm | 2026-08-19T11:56:26.509079Z | 2026-08-19T12:16:40.263489Z |
| pysec-2026-3703 |
7.1 (4.0)
|
### Impact Edit permission lacks ownership check, so another developer could alter metada… | vantage6 | 2026-08-19T11:56:25.597253Z | 2026-08-19T12:16:40.198539Z |
| pysec-2026-3702 |
5.4 (3.1)
4.8 (4.0)
|
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML e… | tablib | 2026-08-19T11:56:25.851164Z | 2026-08-19T12:16:39.585057Z |
| pysec-2026-3701 |
9.8 (3.1)
|
### Impact Prior to version 0.0.19, surfio would not correctly validate size fields in ir… | surfio | 2026-08-19T11:56:28.037745Z | 2026-08-19T12:16:39.528927Z |
| pysec-2026-3700 |
8.4 (3.1)
|
## Stata Command Injection via Unsanitized `package` in `ado_package_install` ### Summar… | stata-mcp | 2026-08-19T11:56:26.114714Z | 2026-08-19T12:16:39.390768Z |
| pysec-2026-3699 |
8.7 (4.0)
|
### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS… | sqlparse | 2026-08-19T11:56:27.060920Z | 2026-08-19T12:16:39.313909Z |
| pysec-2026-3698 |
7.5 (3.1)
|
### Summary sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerabili… | sqlparse | 2026-08-19T11:56:27.110256Z | 2026-08-19T12:16:39.242165Z |
| pysec-2026-3697 |
8.7 (4.0)
|
### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). #… | sqlparse | 2026-08-19T11:56:27.016412Z | 2026-08-19T12:16:39.177334Z |
| pysec-2026-3696 |
6.2 (4.0)
|
### Summary The documented Python and PHP output modes generate source-code snippets fro… | sqlparse | 2026-08-19T11:56:26.811298Z | 2026-08-19T12:16:39.119951Z |
| pysec-2026-3695 |
3.6 (3.1)
1.1 (4.0)
|
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulne… | sglang | 2026-08-19T11:56:24.847653Z | 2026-08-19T12:16:39.005016Z |
| pysec-2026-3694 |
9.8 (3.1)
|
### Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL fi… | resdata | 2026-08-19T11:56:27.903833Z | 2026-08-19T12:16:38.889157Z |
| pysec-2026-3692 |
6.8 (3.1)
|
### Summary A client that can submit message history to a Pydantic AI UI adapter can ref… | pydantic-ai | 2026-08-19T11:56:26.375850Z | 2026-08-19T12:16:38.279052Z |