PyPI Advisories.

Docling imports plugin entry points before the allow_external_plugins check

• CWE-696
• CWE-829

>=2.27.0, <2.131.0 · fixed in 2.131.0

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

• Command injection

>=1.1.2, <1.10.3 · fixed in 1.10.3

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

• Broken access control

>=1.0.0, <1.10.1 · fixed in 1.10.1

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

• Broken access control

>=1.6.8, <1.9.1 · fixed in 1.9.1

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

• Code injection

>=1.2.0, <1.3.0 || >=1.4.0.dev4, <1.4.0.dev10 · fixed in 1.3.0, 1.4.0.dev10

Hydra: Mutable instantiate policy sets allow target blocklist bypass

• Code injection
• CWE-693

>=1.3.4, <1.3.7 || >=1.4.0.dev4, <1.4.0.dev10 · fixed in 1.3.7, 1.4.0.dev10

PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

• Information disclosure
• Race condition

<1.6.78 · fixed in 1.6.78

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

• CWE-20

<70.0 · fixed in 70.0

Hydra logging configuration permits unsafe callable resolution

• Code injection

<1.3.6 || >=1.4.0.dev0, <1.4.0.dev9 · fixed in 1.3.6, 1.4.0.dev9

Hydra instantiate target blacklist bypasses permit code execution

• CWE-184

>=1.3.4, <1.3.6 || >=1.4.0.dev0, <1.4.0.dev9 · fixed in 1.3.6, 1.4.0.dev9

Twisted: IMAP wildcardToRegexp() ReDoS

• Denial of service

<=26.4.0 · no fixed version yet

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

• Authentication bypass
• CWE-345

>=1.5.0, <1.10.3 · fixed in 1.10.3

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

• Code injection

<4.6.78 · fixed in 4.6.78

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

• Broken access control

<0.1.9 · fixed in 0.1.9

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

• Authentication bypass
• Weak cryptography or TLS

<4.6.78 · fixed in 4.6.78

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

• Authentication bypass
• Broken access control

<4.6.78 · fixed in 4.6.78

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

• Broken access control

<=2.1 · no fixed version yet

wger: Trainer Privilege Escalation - Improper Privilege Management

• Privilege escalation

<=2.1 · no fixed version yet

wger: API credentials remain valid after logout/password change

• Authentication bypass

<=2.1 · no fixed version yet

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

• Cross-site request forgery (CSRF)

<=2.1 · no fixed version yet

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

• Broken access control

<=2.1 · no fixed version yet

Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass

>=0.3.9 · no fixed version yet

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

• Code injection
• CWE-116

<0.29.1 · fixed in 0.29.1

Vyper: Memory corruption using function calls within tuples / nested calls

• Memory corruption
• CWE-129

<0.2.6 · fixed in 0.2.6

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

• Memory corruption
• CWE-682

<0.2.6 · fixed in 0.2.6

Vyper: Return inside for loop more than 1 level deep

• CWE-670
• CWE-691

>=0.1.0b10, <0.2.3 · fixed in 0.2.3

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penal...

• Denial of service

<0.32.0 · fixed in 0.32.0

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

• Denial of service
• CWE-409

>=2.45.0, <2.131.0 · fixed in 2.131.0

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

• Server-side request forgery (SSRF)

<1.10.3 · fixed in 1.10.3

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

• Code injection
• Privilege escalation

<1.10.1 · fixed in 1.10.1

Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

• CWE-409

>=2.45.0, <2.131.0 · fixed in 2.131.0

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

• Information disclosure
• Broken access control

>=2.82.0, <2.118.1 · fixed in 2.118.1

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

• Denial of service

<0.28.0 · fixed in 0.28.0

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

• Information disclosure
• CWE-524

<0.30.0 · fixed in 0.30.0

Werkzeug safe_join() allows Windows special device names

• CWE-67

<3.1.9 · fixed in 3.1.9

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

• Memory corruption

<4.18.2 · fixed in 4.18.2

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

• CWE-177

>=3.5.0, <4.18.2 · fixed in 4.18.2

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

• Server-side request forgery (SSRF)
• CWE-20

>=3.9.0, <4.18.2 · fixed in 4.18.2

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

• CWE-345
• CWE-348

>=2.1.0, <2.15.0 · fixed in 2.15.0

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

• Denial of service

>=0.24.0, <0.30.0 · fixed in 0.30.0

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

• Denial of service

>=0.23.0rc2, <0.30.0 · fixed in 0.30.0

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

• Denial of service
• Broken access control

<0.30.0 · fixed in 0.30.0

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

• CWE-20
• CWE-248

<0.30.0 · fixed in 0.30.0

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

• Broken access control

<0.30.0 · fixed in 0.30.0

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

• CWE-20
• CWE-248

<0.30.0 · fixed in 0.30.0

uv: Path traversal on Windows through wheel extraction

• Path traversal

>=0.12.7, <0.12.18 · fixed in 0.12.18

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

• Path traversal

<1.4.2 · fixed in 1.4.2

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

• Denial of service

>=6.7.0, <6.9.1 · fixed in 6.9.1

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

• Other injection

<4.18.1 · fixed in 4.18.1

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for req...

• Denial of service

<0.30.0 · fixed in 0.30.0

Snowflake drivers writes sensitive information to logs

• Information disclosure

<=1.19.1 · no fixed version yet

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

• Code injection

>=0.9.0, <2026.6.0 · fixed in 2026.6.0

Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

• Information disclosure

>=0.23.0, <0.23.1 · fixed in 0.23.1

LangGraph SDK custom auth silently ignores actions= on resource decorators

• Broken access control

>=0.1.45, <0.4.4 · fixed in 0.4.4

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

• Path traversal

>=2.107.0, <2.120.3 · fixed in 2.120.3

Langflow: Weak Fernet Key via random.seed()

• Weak cryptography or TLS
• CWE-228

<1.10.1 · fixed in 1.10.1

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

• Authentication bypass

>=1.7.0, <1.9.1 · fixed in 1.9.1

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

• Code injection

>=1.7.2, <1.10.1 · fixed in 1.10.1

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution

• Other injection
• Code injection

>=1.3.0, <1.10.3 · fixed in 1.10.3

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docli...

• Information disclosure
• CWE-693

>=2.83.0, <2.131.0 · fixed in 2.131.0