PyPI Advisories.

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

• Code injection

<2.4.3 · fixed in 2.4.3

Stanza: RCE via pickle deserialization in the lemmatizer

• Code injection
• Insecure deserialization

>=1.14.0, <1.15.0 · fixed in 1.15.0

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

• Denial of service

<6.21.4 · fixed in 6.21.4

pypdf has possible large memory usage when parsing page tree

• Denial of service

<6.21.4 · fixed in 6.21.4

pypdf has possible infinite loop when cloning dictionaries

• Denial of service

<6.21.4 · fixed in 6.21.4

Authlib RFC 7592 examples omit registration-access-token client binding

• Broken access control
• CWE-1188

>=0.15, <1.9.1 · fixed in 1.9.1

pypdf has possible long runtimes when retrieving page labels

• Denial of service

<6.21.3 · fixed in 6.21.3

pypdf has possible large memory usage for exceptions in strict mode

• Denial of service
• CWE-405

<6.21.3 · fixed in 6.21.3

pypdf has possible long runtimes/large memory usage for encrypted PDF files

• Denial of service

<6.21.3 · fixed in 6.21.3

pypdf has possible large memory usage when parsing cross-reference streams

• Denial of service

<6.21.3 · fixed in 6.21.3

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

• Denial of service

<0.6.5 · fixed in 0.6.5

pyasn1 has quadratic-complexity denial of service in binary REAL decoding

• Denial of service

<0.6.5 · fixed in 0.6.5

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

• Denial of service

<0.6.5 · fixed in 0.6.5

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

• Denial of service

>=0.3.3, <0.6.5 · fixed in 0.6.5

GraphQL-core has denial of service via memory leak in aborted validations

• Denial of service

>=3.3.0a3, <3.3.1 · fixed in 3.3.1

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

• Broken access control

<4.0.0 · fixed in 4.0.0

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

• Broken access control

>=1.0.0, <1.3.2 · fixed in 1.3.2

joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

• Denial of service

<1.7.6 · fixed in 1.7.6

joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

• Denial of service

<1.7.5 · fixed in 1.7.5

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

• Command injection
• CWE-184

<4.6.78 · fixed in 4.6.78

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

• Denial of service

<6.6 · fixed in 6.6

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

• Open redirect

<6.6 · fixed in 6.6

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

• Denial of service

<6.6 · fixed in 6.6

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

• Weak cryptography or TLS

<4.8.3 · fixed in 4.8.3

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

• Information disclosure
• Broken access control

<3.1.6 · fixed in 3.1.6

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

• Authentication bypass
• CWE-345

<6.2.0 · fixed in 6.2.0

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

• Memory corruption

>=1.2.1, <1.22.0 · fixed in 1.22.0

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

• Denial of service

<1.22.0 · fixed in 1.22.0

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

• Memory corruption
• CWE-195

>=1.4.0, <1.22.0 · fixed in 1.22.0

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

• Memory corruption

<1.22.0 · fixed in 1.22.0

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

• CWE-942

<0.32.0 · fixed in 0.32.0

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

• Denial of service

<0.32.0 · fixed in 0.32.0

vLLM DeepSeek-OCR image processing vulnerable to denial of service

• Denial of service

>=0.11.1, <0.32.0 · fixed in 0.32.0

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

• CWE-20
• CWE-183

<0.32.0 · fixed in 0.32.0

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

• Insecure deserialization

<0.32.0 · fixed in 0.32.0

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)

• CWE-129
• CWE-193

<0.32.0 · fixed in 0.32.0

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

• Denial of service

>=0.16.0, <0.32.0 · fixed in 0.32.0

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

• Denial of service

>=0.19.0, <0.32.0 · fixed in 0.32.0

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

• Information disclosure

>=0.4.15, <0.4.32 · fixed in 0.4.32

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

• Denial of service
• CWE-409

>=26.7.1, <26.10.1 · fixed in 26.10.1

LangGraph JavaScript custom authentication may permit cross-user Store access

• Broken access control

>=0.1.2, <0.15.0 · fixed in 0.15.0

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

• Race condition

>=4.1.0, <4.2.1 · fixed in 4.2.1

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

• Broken access control

>=3.30.0, <4.2.1 · fixed in 4.2.1

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

• CWE-283

>=3.30.0, <4.2.1 · fixed in 4.2.1

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

• Broken access control

>=3.10.0, <4.2.1 · fixed in 4.2.1

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

• Denial of service

>=3.20.4, <4.2.1 · fixed in 4.2.1

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

• CWE-345

>=3.22.0, <4.2.1 · fixed in 4.2.1

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

• Path traversal

>=3.32.6, <4.2.1 · fixed in 4.2.1

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

• CWE-706

<4.2.1 · fixed in 4.2.1

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

• Path traversal
• Information disclosure

>=3.20.4, <4.0.9 · fixed in 4.0.9

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

• CWE-363

>=3.30.0, <4.2.1 · fixed in 4.2.1

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

• CWE-62

>=4.0.0, <4.2.1 · fixed in 4.2.1

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

• Race condition

>=3.22.0, <4.2.1 · fixed in 4.2.1

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

• Path traversal

>=1.2.3, <1.2.14 · fixed in 1.2.14

rucio has an Authorization Bypass on REST API endpoint for signing URLs

• Broken access control

>=1.16.1, <35.9.0 || >=36.0.0rc1, <38.6.0 || >=39.0.0rc1, <41.0.0rc1 · fixed in 35.9.0, 38.6.0, 41.0.0rc1

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

• Path traversal

>=3.10.0, <3.17.0 · fixed in 3.17.0

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

• Information disclosure

>=2.19.0, <3.17.0 · fixed in 3.17.0

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

• Code injection

>=3.12.0rc0, <3.17.0 · fixed in 3.17.0

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

• Broken access control

>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0