← All tracked CVEs
Updated 18:00
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | GHSA-v4x9-3549-crwv: Integer overflow in MongoDB Python Driver BSON encoder can cause out-of-bounds write with large input | secure-packages-rolling | |
| In progress | High | GHSA-vp6j-j7w5-5xjj: PyMongo connection string host parsing decodes %2C/%3A, enabling host injection | secure-packages-rolling | |
| In progress | Medium | GHSA-g6x2-hccm-hh4m: Werkzeug safe_join allows Windows NTFS device names with empty ADS, causing hangs via send_from_directory | secure-packages-26.05 | |
| In progress | Medium | GHSA-8fvv-fgr5-f8ch: PyMongo GridFS API misinterprets hash passed as ID, overriding exact match. | secure-packages-26.05 | |
| In progress | High | GHSA-v4x9-3549-crwv: MongoDB Python BSON encoder integer overflow permits out-of-bounds write with large input | secure-packages-26.05 | |
| In progress | Medium | GHSA-qx36-8mw2-4r3x: PyMongo treats key vault .sock KMS endpoint as Unix socket, enabling local connections | secure-packages-26.05 | |
| In progress | High | GHSA-vp6j-j7w5-5xjj: PyMongo host parsing decodes percent-encoded delimiters, enabling seed list host injection | secure-packages-26.05 | |
| In progress | High | GHSA-f2ff-p2ww-7p4p: sqlparse group_comments O(n²) on comment-only input causes DoS, bypasses token cap | secure-packages-rolling | |
| In progress | Medium | GHSA-cfqr-cjx5-5jcm: sqlparse ReindentFilter CPU DoS from crafted tuple lists causing quadratic offset recomputation | secure-packages-rolling | |
| In progress | High | GHSA-prg7-hcfm-mfcr: sqlparse ReDoS: quadratic lexer regex for dollar-quoted literals and multiline comments | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3699: sqlparse CPU DoS from quadratic TokenList.__init__ stringification on deeply nested SQL | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4170: ReDoS: soupsieve IDENTIFIER/VALUE regex quadratic backtracking on long failing selectors | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-4171: soupsieve css_parser ReDoS: unanchored RE_WS_END search causes O(n^2) on whitespace/comments | secure-packages-rolling | |
| In progress | High | GHSA-8wv5-x4w7-5gww: Infinite loop vulnerability in Apache Thrift Python/Go/PHP/Java bindings prior to 0.24.0 | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3927: Apache Thrift Python: host mismatch certificate validation vulnerability before 0.24.0 | secure-packages-rolling | |
| In progress | Medium | GHSA-3496-9g83-7v6x: sqlparse python/php output modes allow code injection via improper backslash/quote escaping | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3698: sqlparse ReDoS: dollar-quoted literal backreference and multiline comment regex cause CPU exhaustion | secure-packages-rolling | |
| In progress | High | GHSA-6pjx-3pjc-mrj8: Data amplification vulnerability in Apache Thrift Python bindings before 0.24.0 (compressed data) | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3697: Comment-only SQL causes O(n^2) in sqlparse group_comments; DoS bypasses MAX_GROUPING_TOKENS cap | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3926: Infinite loop vulnerability in Apache Thrift Python, Go, PHP, Java bindings before 0.24.0 | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3923: sqlparse reindent tuple-list formatting triggers CPU DoS from repeated statement-prefix offset calculations | secure-packages-rolling | |
| In progress | High | PYSEC-2026-3925: Data amplification vulnerability in Apache Thrift Python bindings before 0.24.0 | secure-packages-rolling | |
| In progress | Medium | GHSA-hwrj-9rr4-24xh: Apache Thrift Python bindings: improper TLS certificate hostname validation vulnerability before 0.24.0 | secure-packages-rolling | |
| In progress | High | GHSA-pwgv-4x5q-6m9f: sqlparse DoS: TokenList.__init__ str(self) triggers O(n*depth) on nested groups | secure-packages-rolling | |
| In progress | Medium | PYSEC-2026-3696: sqlparse python/php output filters allow code injection via improper backslash/quote escaping | secure-packages-rolling | |
| In progress | High | GHSA-8988-9cw3-xx77: urllib3 1.26–2.7 misapplies target TLS settings to HTTPS proxy, risking verification bypass | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-4176: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming with trailing bytes causes high CPU | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4175: urllib3 1.26–2.7 conflates proxy and target TLS, disabling verification, exposing sensitive data | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4177: Malicious chunked responses cause urllib3 streaming API to buffer excessively, risking memory exhaustion | secure-packages-26.05 | |
| In progress | Medium | GHSA-gh4c-6fx4-qh6g: Infinite loop in urllib3 2.6.2–2.7.0 decoding chunked deflate streams, high CPU | secure-packages-26.05 | |
| In progress | High | GHSA-vxq7-64xx-v4gw: urllib3 streaming chunked decoding buffers unbounded chunk-size lines, causing memory exhaustion. | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-4026: AsyncSSH accepts peer channel max packet size 0, causing event loop hang | secure-packages-26.05 | |
| In progress | High | GHSA-94p9-xgh2-xp45: Virtualenv fails to verify downloaded wheel integrity, enabling cache poisoning via compromised index | secure-packages-25.11 | |
| In progress | Medium | GHSA-9h9j-4vrj-gf7g: virtualenv: pyvenv.cfg line-break injection via prompt overrides 'home' and other keys | secure-packages-25.11 | |
| In progress | High | GHSA-x78j-v8h9-3j2q: Unescaped prompt in virtualenv activate.bat allows command injection on Windows | secure-packages-25.11 | |
| In progress | High | GHSA-p58f-9548-mpm2: Command injection in virtualenv activate/activate.fish via double-quoted shlex.quote placeholders | secure-packages-25.11 | |
| In progress | High | PYSEC-2026-4013: activate/activate.fish double-quoting bug enables command execution via paths with shell metacharacters | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-4176: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming causes CPU DoS | secure-packages-25.11 | |
| In progress | High | GHSA-vxq7-64xx-v4gw: urllib3 <2.8.0 streaming buffers unbounded chunk-size fields in chunked responses, causing memory exhaustion | secure-packages-25.11 | |
| In progress | High | GHSA-8988-9cw3-xx77: urllib3 1.26–2.7 conflates proxy and target TLS configs, risking HTTPS proxy impersonation | secure-packages-25.11 | |
| In progress | High | PYSEC-2026-4177: urllib3 <2.8.0 streaming chunked responses risk memory exhaustion from oversized chunk-size field | secure-packages-25.11 | |
| In progress | Medium | GHSA-gh4c-6fx4-qh6g: urllib3 2.6.2–2.7.0 infinite loop on chunked deflate streaming causes CPU exhaustion | secure-packages-25.11 | |
| In progress | High | PYSEC-2026-4175: Proxy/target TLS settings conflated in urllib3, disabling HTTPS proxy verification; MITM risk | secure-packages-25.11 | |
| In progress | Medium | PYSEC-2026-4113: oauthlib RevocationEndpoint JSONP reflects unvalidated callback, enabling arbitrary JavaScript injection | secure-packages-26.05 | |
| In progress | High | GHSA-27vj-qcqg-25rc: Unsandboxed Jinja2 in fsspec ReferenceFileSystem allows RCE via Kerchunk references JSON | secure-packages-26.05 | |
| In progress | Medium | GHSA-hj66-6f7g-4r5v: JSONP callback injection in oauthlib RevocationEndpoint due to unvalidated callback parameter | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-4114: Observable timing discrepancy in oauthlib PKCE code_challenge due to insecure string comparison | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3804: Hugging Face Accelerate <=1.14.0 path traversal via sharded checkpoint weight_map causes file read/DoS | secure-packages-26.05 | |
| In progress | High | GHSA-g6cj-pr64-35w5: Distinguishable pkcs7_decrypt_* errors leak RSA key length, enabling a Bleichenbacher decryption oracle | secure-packages-26.05 | |
| In progress | High | GHSA-rgxp-2hwp-jwgg: Use-after-free in Arrow C++ IPC file pre-buffering with variadic buffers (15.0.0–23.0.0) | secure-packages-26.05 |