PyPI Advisories.

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

• Denial of service

<1.45.0 · fixed in 1.45.0

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

• Information disclosure

>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

• Server-side request forgery (SSRF)

>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0

Hydra legacy target blacklist permits unsafe PyYAML loading

• CWE-184

>=1.3.6, <1.3.8 || >=1.4.0.dev9, <1.4.0rc3 · fixed in 1.3.8, 1.4.0rc3

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

• Authentication bypass
• Weak cryptography or TLS

<1.9.1 · fixed in 1.9.1

Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

• Server-side request forgery (SSRF)

>=1.6.0, <1.9.0 · fixed in 1.9.0

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

• Authentication bypass
• CWE-807

<1.9.0 · fixed in 1.9.0

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

• Authentication bypass
• CWE-1188

<1.9.0 · fixed in 1.9.0

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

• Broken access control

<1.9.0 · fixed in 1.9.0

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

• Weak cryptography or TLS
• CWE-184

>=1.3.1, <1.9.0 · fixed in 1.9.0

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

• Weak cryptography or TLS
• Open redirect

<1.8.0 · fixed in 1.8.0

dnspython dns.name.from_wire_parser() excessive CPU use

• Denial of service

<2.9.0 · fixed in 2.9.0

Datadog dd-trace-py: ReDoS in URL query string obfuscation

• Denial of service

>=1.5.0, <3.19.9 || >=4.0.0, <4.15.6 · fixed in 3.19.9, 4.15.6

Datadog dd-trace-py: IAST instrumentation can lead to application DOS

• CWE-248

>=3.13.0, <4.15.5 · fixed in 4.15.5

MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

• Memory corruption

>=3.9.0, <4.18.3 · fixed in 4.18.3

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

• Code injection
• CWE-829

>=0.7.3, <0.31.0 · fixed in 0.31.0

Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

• Path traversal

<1.48.0 · fixed in 1.48.0

Strands Agents: Default FileSessionManager storage is world-readable on shared systems

• Broken access control

<1.48.0 · fixed in 1.48.0

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

• Other injection
• CWE-116

>=0.6.0, <0.8.2 · fixed in 0.8.2

LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

• Path traversal
• CWE-20

<1.95.0 · fixed in 1.95.0

LiteLLM vulnerable to reflected XSS in /sso/debug/callback

• Cross-site scripting (XSS)

>=1.65.5, <1.85.0 · fixed in 1.85.0

GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

• Path traversal
• Command injection

<3.2.0 · fixed in 3.2.0

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

• Path traversal

<3.2.0 · fixed in 3.2.0

GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

• Command injection

>=3.1.30, <3.2.0 · fixed in 3.2.0

GitPython command wrappers omit unsafe protocol and option checks

• CWE-1287

<3.2.0 · fixed in 3.2.0

GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name

• Information disclosure

<3.2.0 · fixed in 3.2.0

GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

• Denial of service

<3.2.0 · fixed in 3.2.0

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

• Privilege escalation
• CWE-345

>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2 · fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

• Denial of service
• Memory corruption

<1.2.3 · fixed in 1.2.3

NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment

• Path traversal

<3.10.4 · fixed in 3.10.4

Authlib: empty signatures validation in JWS JSON deserialization

• Weak cryptography or TLS
• CWE-20

<1.9.0 · fixed in 1.9.0

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

• Insecure deserialization

<4.0.9 · fixed in 4.0.9

vllm p2p never connected zmq_exhaustion

• Denial of service

<0.32.0 · fixed in 0.32.0

Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

• Path traversal

<2.0.82 · fixed in 2.0.82

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

• CWE-346

<26.10.0rc1 · fixed in 26.10.0rc1

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

• Denial of service

>=2.5.0, <2.8.8 · fixed in 2.8.8

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

• Server-side request forgery (SSRF)

<2.8.8 · fixed in 2.8.8

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

• Authentication bypass

>=3.3.0, <4.0.1 · fixed in 4.0.1

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

• CWE-20
• CWE-682

<1.6.1 · fixed in 1.6.1

Ajenti has potential Remote Code Execution

• Broken access control

<2.2.13 · fixed in 2.2.13

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inferenc...

• CWE-20

>=0.20.0, <0.30.0 · fixed in 0.30.0

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Im...

• Denial of service

>=0.10.2, <0.25.0 · fixed in 0.25.0

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. At...

• Server-side request forgery (SSRF)

>=0.9.2, <0.24.0 · fixed in 0.24.0

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attac...

• CWE-20

>=0.22.0, <0.24.0 · fixed in 0.24.0

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

• Race condition

>=4.1.0, <4.2.1 · fixed in 4.2.1

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

• Race condition

>=3.20.4, <4.2.1 · fixed in 4.2.1

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

• CWE-667

>=3.22.0, <4.2.1 · fixed in 4.2.1

virtualenv: Temporary app-data can leave dangling seed package links

• CWE-377

>=21.14.8, <21.14.10 · fixed in 21.14.10

virtualenv: Pip seeding with download omits wheel digest verification

• CWE-494

<21.14.9 · fixed in 21.14.9

virtualenv: Downloaded wheel selection and caching precede verification

• CWE-354

<21.14.9 · fixed in 21.14.9

virtualenv: Xonsh activation literals depend on the script decoding codec

• Code injection

<21.14.9 · fixed in 21.14.9

virtualenv: Seeded files retain permissions from an older cache

• Broken access control

<21.14.9 · fixed in 21.14.9

virtualenv: Bash prompt values can change meaning under older compatibility modes

• Command injection

<21.14.9 · fixed in 21.14.9

virtualenv: Venv configuration readback can reinterpret path boundaries

• Other injection

<21.14.9 · fixed in 21.14.9

virtualenv: Seed replacement does not contain metadata deletion paths

• Path traversal

<21.14.9 · fixed in 21.14.9

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

• Code injection
• Server-side request forgery (SSRF)

>=3.12.0rc0, <3.17.0 · fixed in 3.17.0

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

• Broken access control
• CWE-20

<3.1.3 · fixed in 3.1.3

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

• CWE-694

>=4.1.0, <4.2.1 · fixed in 4.2.1

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

• Path traversal
• CWE-363

>=4.1.0, <4.2.1 · fixed in 4.2.1

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

• Path traversal
• CWE-363

>=3.20.4, <4.2.1 · fixed in 4.2.1