# PyPI Advisories.

Every PyPI Advisory we hold (Python), newest first.

## Records, newest first

- [Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE](https://agentprime.io/advisories/GHSA-64vx-6h2c-rjh7.md)
  `GHSA-64vx-6h2c-rjh7`, `CVE-2026-61536` · PyPI `banks`: affected `<2.4.3`, fixed in `2.4.3` · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection
- [Stanza: RCE via pickle deserialization in the lemmatizer](https://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5.md)
  `GHSA-gh9r-c94j-cmp5`, `CVE-2026-115878` · PyPI `stanza`: affected `>=1.14.0, <1.15.0`, fixed in `1.15.0` · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, Insecure deserialization
- [pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search](https://agentprime.io/advisories/GHSA-5849-834g-hvw5.md)
  `GHSA-5849-834g-hvw5`, `CVE-2026-119203` · PyPI `pypdf`: affected `<6.21.4`, fixed in `6.21.4` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pypdf has possible large memory usage when parsing page tree](https://agentprime.io/advisories/GHSA-cggf-277g-3q54.md)
  `GHSA-cggf-277g-3q54`, `CVE-2026-119204` · PyPI `pypdf`: affected `<6.21.4`, fixed in `6.21.4` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pypdf has possible infinite loop when cloning dictionaries](https://agentprime.io/advisories/GHSA-mfr5-77xh-9j7h.md)
  `GHSA-mfr5-77xh-9j7h`, `CVE-2026-119205` · PyPI `pypdf`: affected `<6.21.4`, fixed in `6.21.4` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [Authlib RFC 7592 examples omit registration-access-token client binding](https://agentprime.io/advisories/GHSA-c73q-w75p-j82v.md)
  `GHSA-c73q-w75p-j82v`, `CVE-2026-116672` · PyPI `authlib`: affected `>=0.15, <1.9.1`, fixed in `1.9.1` · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-1188
- [pypdf has possible long runtimes when retrieving page labels](https://agentprime.io/advisories/GHSA-42gh-23hr-vphw.md)
  `GHSA-42gh-23hr-vphw`, `CVE-2026-119206` · PyPI `pypdf`: affected `<6.21.3`, fixed in `6.21.3` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pypdf has possible large memory usage for exceptions in strict mode](https://agentprime.io/advisories/GHSA-4vqv-7265-gm2w.md)
  `GHSA-4vqv-7265-gm2w`, `CVE-2026-119207` · PyPI `pypdf`: affected `<6.21.3`, fixed in `6.21.3` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service, CWE-405
- [pypdf has possible long runtimes/large memory usage for encrypted PDF files](https://agentprime.io/advisories/GHSA-62m5-6wh8-28x7.md)
  `GHSA-62m5-6wh8-28x7`, `CVE-2026-119208` · PyPI `pypdf`: affected `<6.21.3`, fixed in `6.21.3` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pypdf has possible large memory usage when parsing cross-reference streams](https://agentprime.io/advisories/GHSA-x3rh-gjgm-fmqc.md)
  `GHSA-x3rh-gjgm-fmqc`, `CVE-2026-119209` · PyPI `pypdf`: affected `<6.21.3`, fixed in `6.21.3` · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding](https://agentprime.io/advisories/GHSA-2qm8-x737-gmw5.md)
  `GHSA-2qm8-x737-gmw5`, `CVE-2026-119196` · PyPI `pyasn1`: affected `<0.6.5`, fixed in `0.6.5` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pyasn1 has quadratic-complexity denial of service in binary REAL decoding](https://agentprime.io/advisories/GHSA-mm57-4v3p-rchx.md)
  `GHSA-mm57-4v3p-rchx`, `CVE-2026-119197` · PyPI `pyasn1`: affected `<0.6.5`, fixed in `0.6.5` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding](https://agentprime.io/advisories/GHSA-9m75-vc3g-4x39.md)
  `GHSA-9m75-vc3g-4x39`, `CVE-2026-119195` · PyPI `pyasn1`: affected `<0.6.5`, fixed in `0.6.5` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding](https://agentprime.io/advisories/GHSA-fm9c-5rcf-2q5p.md)
  `GHSA-fm9c-5rcf-2q5p`, `CVE-2026-119194` · PyPI `pyasn1`: affected `>=0.3.3, <0.6.5`, fixed in `0.6.5` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [GraphQL-core has denial of service via memory leak in aborted validations](https://agentprime.io/advisories/GHSA-mpqx-q82w-9x46.md)
  `GHSA-mpqx-q82w-9x46`, `CVE-2026-119286` · PyPI `graphql-core`: affected `>=3.3.0a3, <3.3.1`, fixed in `3.3.1` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client](https://agentprime.io/advisories/GHSA-7984-qgvg-3j9c.md)
  `GHSA-7984-qgvg-3j9c`, `CVE-2026-118669` · PyPI `oauthlib`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [OpenWISP Controller CA CRL REST API does not scope requests to managed organizations](https://agentprime.io/advisories/GHSA-9gh4-xw24-9xh5.md)
  `GHSA-9gh4-xw24-9xh5`, `CVE-2026-116677` · PyPI `openwisp-controller`: affected `>=1.0.0, <1.3.2`, fixed in `1.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection](https://agentprime.io/advisories/GHSA-9pg5-8c7x-5hfx.md)
  `GHSA-9pg5-8c7x-5hfx`, `CVE-2026-119284` · PyPI `joserfc`: affected `<1.7.6`, fixed in `1.7.6` · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [joserfc: Unbounded JWE General JSON \`recipients\` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption](https://agentprime.io/advisories/GHSA-jpxq-7h8p-2q76.md)
  `GHSA-jpxq-7h8p-2q76`, `CVE-2026-119283` · PyPI `joserfc`: affected `<1.7.5`, fixed in `1.7.5` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset](https://agentprime.io/advisories/GHSA-vpp8-g58w-m8mp.md)
  `GHSA-vpp8-g58w-m8mp` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox](https://agentprime.io/advisories/GHSA-26mh-57q7-jfvr.md)
  `GHSA-26mh-57q7-jfvr`, `CVE-2026-61438` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 7.0 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, CWE-184, CWE-693
- [Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks](https://agentprime.io/advisories/GHSA-r4j5-9xpp-3985.md)
  `GHSA-r4j5-9xpp-3985`, `CVE-2026-115927` · PyPI `tornado`: affected `<6.6`, fixed in `6.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Tornado: Open redirect in RedirectHandler via protocol-relative URLs](https://agentprime.io/advisories/GHSA-pw9p-v7r6-gx4p.md)
  `GHSA-pw9p-v7r6-gx4p`, `CVE-2026-116578` · PyPI `tornado`: affected `<6.6`, fixed in `6.6` · CVSS 2.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Open redirect
- [Tornado: Quadratic CPU usage when parsing HTTP headers with line folding](https://agentprime.io/advisories/GHSA-pcg2-g6cj-q92c.md)
  `GHSA-pcg2-g6cj-q92c`, `CVE-2026-116577` · PyPI `tornado`: affected `<6.6`, fixed in `6.6` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it](https://agentprime.io/advisories/GHSA-6jp4-8v48-cc5v.md)
  `GHSA-6jp4-8v48-cc5v`, `CVE-2026-117601` · PyPI `electrum`: affected `<4.8.3`, fixed in `4.8.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS
- [Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build_session_scope)](https://agentprime.io/advisories/GHSA-5324-3w58-qpp2.md)
  `GHSA-5324-3w58-qpp2`, `CVE-2026-116575` · npm `mem0ai` and 1 more: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, Broken access control
- [Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim](https://agentprime.io/advisories/GHSA-h2r5-x5m7-3935.md)
  `GHSA-h2r5-x5m7-3935`, `CVE-2026-115910` · PyPI `social-auth-core`: affected `<6.2.0`, fixed in `6.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, CWE-345
- [ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank](https://agentprime.io/advisories/GHSA-6pwm-x34p-fvj2.md)
  `GHSA-6pwm-x34p-fvj2`, `CVE-2026-115920` · PyPI `onnx`: affected `>=1.2.1, <1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs](https://agentprime.io/advisories/GHSA-q69g-f4f5-v8m7.md)
  `GHSA-q69g-f4f5-v8m7`, `CVE-2026-115922` · PyPI `onnx`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute](https://agentprime.io/advisories/GHSA-m4pr-6v3c-6fgr.md)
  `GHSA-m4pr-6v3c-6fgr`, `CVE-2026-115921` · PyPI `onnx`: affected `>=1.4.0, <1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, CWE-195
- [ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)](https://agentprime.io/advisories/GHSA-48m4-24cq-37qf.md)
  `GHSA-48m4-24cq-37qf`, `CVE-2026-115919` · PyPI `onnx`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 6.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://agentprime.io/advisories/GHSA-vvpg-rrww-wpmh.md)
  `GHSA-vvpg-rrww-wpmh`, `CVE-2026-115917`, `PYSEC-2026-4348` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 3.4 Low · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-942
- [vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine](https://agentprime.io/advisories/GHSA-8397-8qf6-f2gm.md)
  `GHSA-8397-8qf6-f2gm`, `CVE-2026-115913` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [vLLM DeepSeek-OCR image processing vulnerable to denial of service](https://agentprime.io/advisories/GHSA-gq5q-89c7-vhvx.md)
  `GHSA-gq5q-89c7-vhvx`, `CVE-2026-115914` · PyPI `vllm`: affected `>=0.11.1, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE](https://agentprime.io/advisories/GHSA-h3rc-j82p-2c3h.md)
  `GHSA-h3rc-j82p-2c3h`, `CVE-2026-115915`, `PYSEC-2026-4346` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20, CWE-183
- [vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled](https://agentprime.io/advisories/GHSA-6757-hggm-hp2w.md)
  `GHSA-6757-hggm-hp2w`, `CVE-2026-115912`, `PYSEC-2026-4345` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization
- [vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)](https://agentprime.io/advisories/GHSA-q97c-p368-75c4.md)
  `GHSA-q97c-p368-75c4`, `CVE-2026-115916`, `PYSEC-2026-4347` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-129, CWE-193
- [vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs](https://agentprime.io/advisories/GHSA-x567-49g5-p4cf.md)
  `GHSA-x567-49g5-p4cf`, `CVE-2026-115918`, `PYSEC-2026-4349` · PyPI `vllm`: affected `>=0.16.0, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool](https://agentprime.io/advisories/GHSA-542m-9234-8gvf.md)
  `GHSA-542m-9234-8gvf`, `CVE-2026-115911`, `PYSEC-2026-4344` · PyPI `vllm`: affected `>=0.19.0, <0.32.0`, fixed in `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [LangGraph CLI prints the registry push token in \`langgraph deploy --verbose\` output](https://agentprime.io/advisories/GHSA-8prr-f582-jqq3.md)
  `GHSA-8prr-f582-jqq3`, `CVE-2026-115885` · PyPI `langgraph-cli`: affected `>=0.4.15, <0.4.32`, fixed in `0.4.32` · CVSS 4.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure
- [Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)](https://agentprime.io/advisories/GHSA-pjh6-c8mg-3x7m.md)
  `GHSA-pjh6-c8mg-3x7m`, `CVE-2026-116579` · PyPI `autobahn`: affected `>=26.7.1, <26.10.1`, fixed in `26.10.1` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-409
- [LangGraph JavaScript custom authentication may permit cross-user Store access](https://agentprime.io/advisories/GHSA-4hm6-w6qq-w73v.md)
  `GHSA-4hm6-w6qq-w73v`, `CVE-2026-118668` · PyPI `langgraph-api`: affected `>=0.1.2, <0.15.0`, fixed in `0.15.0` · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock](https://agentprime.io/advisories/GHSA-wfhq-q4j2-c37m.md)
  `GHSA-wfhq-q4j2-c37m`, `CVE-2026-112941` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 3.3 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition
- [filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold](https://agentprime.io/advisories/GHSA-6627-m3xw-93mp.md)
  `GHSA-6627-m3xw-93mp`, `CVE-2026-112908` · PyPI `filelock`: affected `>=3.30.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion](https://agentprime.io/advisories/GHSA-9c4x-gm8v-wgc4.md)
  `GHSA-9c4x-gm8v-wgc4`, `CVE-2026-112911` · PyPI `filelock`: affected `>=3.30.0, <4.2.1`, fixed in `4.2.1` · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-283
- [filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL](https://agentprime.io/advisories/GHSA-8mx5-7m5m-r77g.md)
  `GHSA-8mx5-7m5m-r77g`, `CVE-2026-112910` · PyPI `filelock`: affected `>=3.10.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout](https://agentprime.io/advisories/GHSA-cwqr-hh33-gh44.md)
  `GHSA-cwqr-hh33-gh44`, `CVE-2026-112915` · PyPI `filelock`: affected `>=3.20.4, <4.2.1`, fixed in `4.2.1` · CVSS 5.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker](https://agentprime.io/advisories/GHSA-rfpc-qcw5-3pc4.md)
  `GHSA-rfpc-qcw5-3pc4`, `CVE-2026-112939` · PyPI `filelock`: affected `>=3.22.0, <4.2.1`, fixed in `4.2.1` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-345
- [filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker](https://agentprime.io/advisories/GHSA-9j6q-wvj5-jgjg.md)
  `GHSA-9j6q-wvj5-jgjg`, `CVE-2026-112912` · PyPI `filelock`: affected `>=3.32.6, <4.2.1`, fixed in `4.2.1` · CVSS 2.5 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path](https://agentprime.io/advisories/GHSA-69hj-f68j-2879.md)
  `GHSA-69hj-f68j-2879`, `CVE-2026-112909` · PyPI `filelock`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-706
- [filelock: ReadWriteLock follows a symlink at the lock path into SQLite](https://agentprime.io/advisories/GHSA-j8f7-rjxc-mr56.md)
  `GHSA-j8f7-rjxc-mr56`, `CVE-2026-112936` · PyPI `filelock`: affected `>=3.20.4, <4.0.9`, fixed in `4.0.9` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Information disclosure
- [filelock: StrictSoftFileLock follows a symbolic link swapped in at \<path>.filelock and creates claim files in a directory another local user chooses](https://agentprime.io/advisories/GHSA-m462-7rxw-wvpg.md)
  `GHSA-m462-7rxw-wvpg`, `CVE-2026-112938` · PyPI `filelock`: affected `>=3.30.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-363
- [filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record](https://agentprime.io/advisories/GHSA-fj95-fr6c-h845.md)
  `GHSA-fj95-fr6c-h845`, `CVE-2026-112934` · PyPI `filelock`: affected `>=4.0.0, <4.2.1`, fixed in `4.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-62
- [filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders](https://agentprime.io/advisories/GHSA-fq56-3cx3-fjxp.md)
  `GHSA-fq56-3cx3-fjxp`, `CVE-2026-112935` · PyPI `filelock`: affected `>=3.22.0, <4.2.1`, fixed in `4.2.1` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition
- [LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests](https://agentprime.io/advisories/GHSA-3fx2-cqw9-xr3c.md)
  `GHSA-3fx2-cqw9-xr3c`, `CVE-2026-118667` · PyPI `langgraph` and 1 more: affected `>=1.2.3, <1.2.14`, fixed in `1.2.14` · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [rucio has an Authorization Bypass on REST API endpoint for signing URLs](https://agentprime.io/advisories/GHSA-5j9r-fx4x-rpvg.md)
  `GHSA-5j9r-fx4x-rpvg`, `CVE-2026-58273` · PyPI `rucio`: affected `>=1.16.1, <35.9.0 || >=36.0.0rc1, <38.6.0 || >=39.0.0rc1, <41.0.0rc1`, fixed in `35.9.0`, `38.6.0`, `41.0.0rc1` · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source](https://agentprime.io/advisories/GHSA-m65p-9j7q-6w33.md)
  `GHSA-m65p-9j7q-6w33`, `CVE-2026-116690` · PyPI `mlflow`: affected `>=3.10.0, <3.17.0`, fixed in `3.17.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [MLflow CrewAI autologging records LLM provider API keys in logged trace spans](https://agentprime.io/advisories/GHSA-j7qq-vr8c-xvw3.md)
  `GHSA-j7qq-vr8c-xvw3`, `CVE-2026-116691` · PyPI `mlflow`: affected `>=2.19.0, <3.17.0`, fixed in `3.17.0` · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure
- [MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules](https://agentprime.io/advisories/GHSA-26p8-2jq9-3vq9.md)
  `GHSA-26p8-2jq9-3vq9`, `CVE-2026-116692` · PyPI `mlflow`: affected `>=3.12.0rc0, <3.17.0`, fixed in `3.17.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server](https://agentprime.io/advisories/GHSA-w4fh-qvv9-3v23.md)
  `GHSA-w4fh-qvv9-3v23`, `CVE-2026-116684` · PyPI `mcp`: affected `>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0`, fixed in `1.30.0`, `2.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control

Older: <https://agentprime.io/advisories/ecosystem/pypi.md?cursor=WyIyMDI2LTEwLTI3VDIxOjA2OjU5LjAwMDAwMFoiLCJHSFNBLXc0ZmgtcXZ2OS0zdjIzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=PyPI>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/pypi/>. Everything for agents: <https://agentprime.io/llms.txt>.