← All tracked CVEs
Updated 00:00
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-x78j-v8h9-3j2q: Unescaped prompt in virtualenv activate.bat allows command injection on Windows | secure-packages-25.11 | — | |
| In progress | GHSA-p58f-9548-mpm2: Command injection in virtualenv activate/activate.fish via double-quoted shlex.quote placeholders | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-4013: activate/activate.fish double-quoting bug enables command execution via paths with shell metacharacters | secure-packages-25.11 | — | |
| In progress | GHSA-vxq7-64xx-v4gw: urllib3 <2.8.0 streaming buffers unbounded chunk-size fields in chunked responses, causing memory exhaustion | secure-packages-25.11 | — | |
| In progress | GHSA-8988-9cw3-xx77: urllib3 1.26–2.7 conflates proxy and target TLS configs, risking HTTPS proxy impersonation | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-4177: urllib3 <2.8.0 streaming chunked responses risk memory exhaustion from oversized chunk-size field | secure-packages-25.11 | — | |
| In progress | PYSEC-2026-4175: Proxy/target TLS settings conflated in urllib3, disabling HTTPS proxy verification; MITM risk | secure-packages-25.11 | — | |
| In progress | GHSA-27vj-qcqg-25rc: Unsandboxed Jinja2 in fsspec ReferenceFileSystem allows RCE via Kerchunk references JSON | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3804: Hugging Face Accelerate <=1.14.0 path traversal via sharded checkpoint weight_map causes file read/DoS | secure-packages-26.05 | — | |
| In progress | GHSA-g6cj-pr64-35w5: Distinguishable pkcs7_decrypt_* errors leak RSA key length, enabling a Bleichenbacher decryption oracle | secure-packages-26.05 | — | |
| In progress | GHSA-rgxp-2hwp-jwgg: Use-after-free in Arrow C++ IPC file pre-buffering with variadic buffers (15.0.0–23.0.0) | secure-packages-26.05 | — | |
| In progress | GHSA-m2h6-j472-rp4c: python-cryptography accepts wildcard SAN violating DNS name constraints, enabling sub-CA scope escape | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3553: Exponential blowup from no deduplication of duplicate self-signed issuers in chain building | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2047: wheel/setuptools unpack path traversal enables arbitrary file permission modification via unsanitized zinfo.filename | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4155: pypdf vulnerability: malicious PDF /Widths in TrueType/Type1 fonts triggers excessive memory usage during parsing | secure-packages-26.05 | — | |
| In progress | GHSA-jwv3-5hgf-82ww: Exponential blowup in certificate chain building with duplicate self-signed certs enables DoS | secure-packages-26.05 | — | |
| In progress | GHSA-g9cg-prrw-2r8q: Attacker-crafted PDF causes high memory usage when parsing font /Widths in pypdf | secure-packages-26.05 | — | |
| In progress | GHSA-537c-gmf6-5ccf: Cryptography wheels <48.0.1 contain vulnerable statically linked OpenSSL; affects PyPI users | secure-packages-26.05 | — | |
| In progress | GHSA-8rrh-rw8j-w5fx: wheel/setuptools unpack path traversal enables arbitrary file permission changes outside extraction directory | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4157: pypdf vulnerability: crafted PDFs cause long runtimes during form field flattening appearance generation | secure-packages-26.05 | — | |
| In progress | GHSA-qv6h-rv94-w285: pypdf vulnerability: page labels with large Roman numerals cause excessive memory usage | secure-packages-26.05 | — | |
| In progress | GHSA-xf7x-x43h-rpqh: Circular JSON Schema $ref in json_repair resolve_schema causes infinite loop CPU DoS | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3863: Mistune v3.3.2 DoS: deep emphasis recursion triggers RecursionError with ~1000 asterisks | secure-packages-26.05 | — | |
| In progress | GHSA-php9-fj8v-98fj: pypdf vulnerability: crafted PDFs cause long runtimes during form field flattening appearance stream generation | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3552: Distinct pkcs7_decrypt_* failures leak RSA-decoded length, enabling Bleichenbacher oracle | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4153: pypdf vulnerability: crafted PDFs with long non-whitespace-terminated object headers cause long runtimes | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4159: pypdf vulnerability: crafted PDFs cause long runtimes via dictionary-based embedded files API | secure-packages-26.05 | — | |
| In progress | GHSA-6m44-fpc8-c3rq: Mistune 3.3.2 DoS from RecursionError rendering deeply nested emphasis/strong tokens | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4158: pypdf vulnerability: large Roman numeral page labels trigger high memory usage | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-87: lxml <6.1.0 XXE vulnerability allows local file reads via default entity resolution. | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4154: pypdf ToUnicode parsing causes excessive memory usage on crafted PDFs during text extraction | secure-packages-26.05 | — | |
| In progress | GHSA-wf93-45jw-7689: pip treats console_scripts/gui_scripts as paths; installs entry points outside installation directory | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4013: Activation scripts double-quote shlex.quote, allowing command injection from relocated venv/fish library paths. | secure-packages-26.05 | — | |
| In progress | GHSA-q38v-wp89-2w55: _uid fails to reset supplementary groups, enabling unintended privileged access in child processes | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2617: Windows backslash traversal bypasses Mako template directory checks, enabling file disclosure | secure-packages-26.05 | — | |
| In progress | GHSA-jw7q-gvrg-4vj3: pypdf: malformed /FlateDecode stream can cause excessive runtimes via byte-by-byte decompression | secure-packages-26.05 | — | |
| In progress | GHSA-v247-6f48-mgcj: pypdf vulnerability: crafted PDF triggers long runtimes when accessing embedded files via dictionary API | secure-packages-26.05 | — | |
| In progress | GHSA-v92g-xgxw-vvmm: Path traversal via double-slash URIs in TemplateLookup.get_template enabling arbitrary file read | secure-packages-26.05 | — | |
| In progress | GHSA-6966-vjj6-99xv: JupyterLab 4.5–4.6.3 system clipboard paste preserves trusted metadata; executes output scripts | secure-packages-26.05 | — | |
| In progress | GHSA-vfmq-68hx-4jfw: Default lxml resolve_entities allows untrusted XML to read local files (XXE vulnerability) | secure-packages-26.05 | — | |
| In progress | GHSA-hqmj-h5c6-369m: onnx.hub.load silent=True disables trust prompts; integrity check ineffective; unverified repos enable RCE | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4160: pypdf vulnerability: large alphabetical page labels cause excessive memory usage via crafted PDF | secure-packages-26.05 | — | |
| In progress | GHSA-94p9-xgh2-xp45: Unverified network-fetched wheels in virtualenv allow cache poisoning via compromised indexes or MITM | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4112: JupyterLab system clipboard paste XSS: trusted cell outputs execute attacker scripts (4.5–4.6.3) | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3625: Out-of-bounds read/crash DoS on msgpack Unpacker reuse after error (pre-1.2.1) | secure-packages-26.05 | — | |
| In progress | GHSA-p58f-9548-mpm2: virtualenv bash/zsh and fish activation scripts vulnerable to command injection via doubled quoting | secure-packages-26.05 | — | |
| In progress | GHSA-4j2p-28q2-5m79: Hugging Face Accelerate ≤1.14.0 path traversal via unsanitized weight_map enables file read/DoS | secure-packages-26.05 | — | |
| In progress | GHSA-fp3h-c4fm-7vvf: Crafted PDF exploits pypdf /ToUnicode parsing, causing excessive memory usage during text extraction | secure-packages-26.05 | — | |
| In progress | GHSA-mpf4-983q-p7j4: Tornado server DoS: parse_qs without max_num_fields on urlencoded request bodies | secure-packages-26.05 | — | |
| In progress | GHSA-w23x-9jrw-r45c: Crafted PDF with large alphabetical page labels causes high memory use in pypdf | secure-packages-26.05 | — |