← All tracked CVEs
Updated 19:00
936 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | PYSEC-2026-4157: pypdf vulnerability: crafted PDFs cause long runtimes during form field flattening appearance generation | secure-packages-26.05 | |
| In progress | High | GHSA-qv6h-rv94-w285: pypdf vulnerability: page labels with large Roman numerals cause excessive memory usage | secure-packages-26.05 | |
| In progress | High | GHSA-xf7x-x43h-rpqh: Circular JSON Schema $ref in json_repair resolve_schema causes infinite loop CPU DoS | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-3913: pypdf TreeObject.insert_child vulnerability allows malicious PDF to cause infinite loop | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-2875: pip installs dual-format tar+zip archives as ZIP, causing confusing or incorrect installations | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3863: Mistune v3.3.2 DoS: deep emphasis recursion triggers RecursionError with ~1000 asterisks | secure-packages-26.05 | |
| In progress | High | GHSA-php9-fj8v-98fj: pypdf vulnerability: crafted PDFs cause long runtimes during form field flattening appearance stream generation | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3552: Distinct pkcs7_decrypt_* failures leak RSA-decoded length, enabling Bleichenbacher oracle | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4153: pypdf vulnerability: crafted PDFs with long non-whitespace-terminated object headers cause long runtimes | secure-packages-26.05 | |
| In progress | Low | PYSEC-2026-1796: pip wheel extraction path traversal allows files outside installation directory | secure-packages-26.05 | |
| In progress | Medium | GHSA-qwm4-qh6w-59xr: pip double-encoded URL bug allows arbitrary file writes when installing wheels from malicious indexes | secure-packages-26.05 | |
| In progress | Medium | GHSA-8v8h-hg4w-mvq2: python-hyper/hpack unbounded varint decoding causes O(n^2) DoS on malformed input | secure-packages-26.05 | |
| In progress | Medium | GHSA-h35f-9h28-mq5c: setuptools FileList MANIFEST.in excludes ignore Unicode normalization, leaking files on macOS APFS/HFS+ sdists | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4159: pypdf vulnerability: crafted PDFs cause long runtimes via dictionary-based embedded files API | secure-packages-26.05 | |
| In progress | High | GHSA-6m44-fpc8-c3rq: Mistune 3.3.2 DoS from RecursionError rendering deeply nested emphasis/strong tokens | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-3721: pip arbitrary file write via double-encoded package URLs from malicious index when downloading wheels | secure-packages-26.05 | |
| In progress | Medium | GHSA-58qw-9mgm-455v: pip misclassifies dual tar/ZIP archives as ZIP, leading to confusing, potentially incorrect installs | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4158: pypdf vulnerability: large Roman numeral page labels trigger high memory usage | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-87: lxml <6.1.0 XXE vulnerability allows local file reads via default entity resolution. | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4154: pypdf ToUnicode parsing causes excessive memory usage on crafted PDFs during text extraction | secure-packages-26.05 | |
| In progress | High | GHSA-wf93-45jw-7689: pip treats console_scripts/gui_scripts as paths; installs entry points outside installation directory | secure-packages-26.05 | |
| In progress | Medium | GHSA-763m-79hh-57f2: pypdf text extraction vulnerability causes excessive runtime and memory with many or reused XForm objects | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-3716: Datasets <=5.0.0 unvalidated file_name enables path traversal, arbitrary file read in folder builders | secure-packages-26.05 | |
| In progress | Medium | GHSA-jp53-mhqp-8xcg: Crafted PDF triggers infinite loop via pypdf TreeObject.insert_child, causing DoS (pre-6.16.0) | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4013: Activation scripts double-quote shlex.quote, allowing command injection from relocated venv/fish library paths. | secure-packages-26.05 | |
| In progress | High | GHSA-q38v-wp89-2w55: _uid fails to reset supplementary groups, enabling unintended privileged access in child processes | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-2617: Windows backslash traversal bypasses Mako template directory checks, enabling file disclosure | secure-packages-26.05 | |
| In progress | Medium | GHSA-379c-qx7v-6h59: Path traversal via file_name leaks local files in Datasets <=5.0.0 folder builders | secure-packages-26.05 | |
| In progress | High | GHSA-jw7q-gvrg-4vj3: pypdf: malformed /FlateDecode stream can cause excessive runtimes via byte-by-byte decompression | secure-packages-26.05 | |
| In progress | High | GHSA-v247-6f48-mgcj: pypdf vulnerability: crafted PDF triggers long runtimes when accessing embedded files via dictionary API | secure-packages-26.05 | |
| In progress | High | GHSA-v92g-xgxw-vvmm: Path traversal via double-slash URIs in TemplateLookup.get_template enabling arbitrary file read | secure-packages-26.05 | |
| In progress | High | GHSA-6966-vjj6-99xv: JupyterLab 4.5–4.6.3 system clipboard paste preserves trusted metadata; executes output scripts | secure-packages-26.05 | |
| In progress | High | GHSA-vfmq-68hx-4jfw: Default lxml resolve_entities allows untrusted XML to read local files (XXE vulnerability) | secure-packages-26.05 | |
| In progress | High | GHSA-hqmj-h5c6-369m: onnx.hub.load silent=True disables trust prompts; integrity check ineffective; unverified repos enable RCE | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4160: pypdf vulnerability: large alphabetical page labels cause excessive memory usage via crafted PDF | secure-packages-26.05 | |
| In progress | High | GHSA-94p9-xgh2-xp45: Unverified network-fetched wheels in virtualenv allow cache poisoning via compromised indexes or MITM | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4112: JupyterLab system clipboard paste XSS: trusted cell outputs execute attacker scripts (4.5–4.6.3) | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-2876: pip self-update check runs after wheel install, imports newly-installed modules, potential security risk | secure-packages-26.05 | |
| In progress | Low | GHSA-v9pg-7xvm-68hf: Negative Content-Length makes parse_form read until EOF, loading full body at once. | secure-packages-26.05 | |
| In progress | Medium | GHSA-rrmf-rvhw-rf47: Critical memory corruption in PyTorch 2.6.0 torch.jit.script; local exploit publicly disclosed | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3625: Out-of-bounds read/crash DoS on msgpack Unpacker reuse after error (pre-1.2.1) | secure-packages-26.05 | |
| In progress | High | GHSA-p58f-9548-mpm2: virtualenv bash/zsh and fish activation scripts vulnerable to command injection via doubled quoting | secure-packages-26.05 | |
| In progress | High | GHSA-4j2p-28q2-5m79: Hugging Face Accelerate ≤1.14.0 path traversal via unsanitized weight_map enables file read/DoS | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-4024: AnyIO process-pool leaves stderr pipe undrained, enabling deadlock via large stderr output | secure-packages-26.05 | |
| In progress | High | GHSA-fp3h-c4fm-7vvf: Crafted PDF exploits pypdf /ToUnicode parsing, causing excessive memory usage during text extraction | secure-packages-26.05 | |
| In progress | Medium | GHSA-hwpq-hmq9-wj77: ONNX version_converter SIGSEGV in Upsample 6→7 adapter on zero-input node due to unguarded inputs()[0] access | secure-packages-26.05 | |
| In progress | High | GHSA-mpf4-983q-p7j4: Tornado server DoS: parse_qs without max_num_fields on urlencoded request bodies | secure-packages-26.05 | |
| In progress | Medium | GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource follows external symlinks, enabling out-of-tree read and size cap bypass | secure-packages-26.05 | |
| In progress | High | GHSA-w23x-9jrw-r45c: Crafted PDF with large alphabetical page labels causes high memory use in pypdf | secure-packages-26.05 | |
| In progress | High | GHSA-xrqw-3rrv-vx5w: Transformers <5.10.0 save_pretrained path traversal enables arbitrary file writes via tokenizer_config chat_template | secure-packages-26.05 |