PyPI Advisories.

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

• Authentication bypass
• CWE-1385

<0.35.0 · fixed in 0.35.0

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7

Vibe-Trading file-read tools expose arbitrary server-readable files

• Path traversal
• Information disclosure

>=0.1.0, <0.1.7 · fixed in 0.1.7

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

• Command injection
• Code injection

>=0.1.0, <0.1.7 · fixed in 0.1.7

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

• Denial of service

<2.5.0 · fixed in 2.5.0

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

• Path traversal

<1.2.9 · fixed in 1.2.9

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

• Denial of service

<1.2.9 · fixed in 1.2.9

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

• Path traversal
• CWE-61

>=0.24.0, <1.2.8 · fixed in 1.2.8

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

• Path traversal

>=0.23.1, <1.2.8 · fixed in 1.2.8

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

• Path traversal

>=0.22.5, <1.2.8 · fixed in 1.2.8

Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

>=1.7.2 · no fixed version yet

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

• Cross-site scripting (XSS)
• CWE-345

>=7.5.0, <7.6.3 · fixed in 7.6.3

OpenStack Swift vulnerable to authenticated server-side request forgery

• Server-side request forgery (SSRF)

<2.37.2 · fixed in 2.37.2

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

• Cross-site scripting (XSS)
• Code injection

>=3.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

• Command injection
• Information disclosure

>=4.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

virtualenv bash and fish activation scripts execute commands embedded in paths

• Command injection

<21.7.13 · fixed in 21.7.13

virtualenv: Command injection via --prompt in activate.bat (batch activator)

• Command injection

<21.7.12 · fixed in 21.7.12

pypdf: Possible long runtimes with large amount of embedded files

• Denial of service

<6.19.0 · fixed in 6.19.0

pypdf: Possible long runtimes when generating appearance streams

• Denial of service

<6.19.0 · fixed in 6.19.0

pypdf: Possible large memory usage when retrieving alphabetical page labels

• Denial of service

<6.19.0 · fixed in 6.19.0

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

• Denial of service

<6.18.1 · fixed in 6.18.1

pypdf: Possible large memory usage when parsing font data

• Denial of service

<6.18.1 · fixed in 6.18.1

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

• Denial of service

<6.18.1 · fixed in 6.18.1

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

• Denial of service

<6.18.0 · fixed in 6.18.0

pypdf: Possible large memory usage when retrieving Roman page labels

• Denial of service

<6.17.0 · fixed in 6.17.0

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

• CWE-494

<21.7.12 · fixed in 21.7.12

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

• Other injection

<21.7.11 · fixed in 21.7.11

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

• CWE-471

>=2.11.0, <=2.13.0 · no fixed version yet

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

• Denial of service

<6.5.9 · fixed in 6.5.9

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

• Denial of service
• CWE-409

<6.5.9 · fixed in 6.5.9

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

• Path traversal

<6.5.9 · fixed in 6.5.9

GitPython submodule update path traversal can write outside the repository

• Path traversal

<3.1.62 · fixed in 3.1.62

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

• Denial of service

<3.1.60 · fixed in 3.1.60

GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

• Command injection
• Information disclosure

>=3.1.59, <3.1.60 · fixed in 3.1.60

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

• Code injection
• CWE-427

<3.1.60 · fixed in 3.1.60

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

• Server-side request forgery (SSRF)

<1.88.6 || >=1.89.0, <1.89.7 || >=1.90.0, <1.90.7 || >=1.91.0, <1.91.5 || >=1.92.0, <1.92.2 || >=1.93.0, <1.93.2 || >=1.94.0, <1.94.3 || >=1.95.0, <1.95.1 || >=1.96.0, <1.96.2 · fixed in 1.88.6, 1.89.7, 1.90.7, 1.91.5, 1.92.2, 1.93.2, 1.94.3, 1.95.1, 1.96.2

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a ...

• Denial of service

<0.27.0 · fixed in 0.27.0

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

• CWE-248

>=2.0.0a1, <2.15.0 · fixed in 2.15.0

urllib3: Chunked Deflate streaming can enter an infinite loop

• Denial of service

>=2.6.2, <2.8.0 · fixed in 2.8.0

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

• Denial of service

>=1.10.3, <2.8.0 · fixed in 2.8.0

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

• Weak cryptography or TLS
• CWE-440

>=1.26.0, <2.8.0 · fixed in 2.8.0

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

• Denial of service

<2.14.0 · fixed in 2.14.0

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

• Denial of service

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

• CWE-180

<2.14.0 · fixed in 2.14.0

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

• Weak cryptography or TLS

<2.14.0 · fixed in 2.14.0

PyJWT accepts public JWK containers as HMAC secrets

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: PyJWKClient follows redirects when fetching JWKS

• Information disclosure
• Server-side request forgery (SSRF)

<2.14.0 · fixed in 2.14.0

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

• Weak cryptography or TLS

>=2.4.0, <2.14.0 · fixed in 2.14.0

PyJWT BOM Bypass

• Weak cryptography or TLS

>=2.13.0, <2.14.0 · fixed in 2.14.0

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

• Denial of service

<2.14.0 · fixed in 2.14.0

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

• CWE-755

>=2.9.0, <2.14.0 · fixed in 2.14.0

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

• CWE-208

>=3.0.0, <4.0.0 · fixed in 4.0.0

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

• Cross-site scripting (XSS)

>=0.6.1, <4.0.0 · fixed in 4.0.0

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}....

• Hard-coded credentials

<6.18.0 · fixed in 6.18.0

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that ...

• Other injection

<22.6.0 · fixed in 22.6.0

Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserialization

• CWE-20

* · no fixed version yet

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and o...

• Code injection

<1.6.1rc0 · fixed in 1.6.1rc0

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in ...

• Insecure deserialization

· no fixed version yet

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passe...

• Code injection

<1.6.1rc0 · fixed in 1.6.1rc0