← All tracked CVEs
Updated 20:00
867 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | Critical | PYSEC-2026-4025: AnyIO connect_tcp/TLSStream IDN TLS validation accepts IDNA 2003 spoofed certificates | secure-packages-26.05 | |
| In progress | Medium | GHSA-m6qw-4cw2-hm4m: Header injection via attacker-controlled multipart/payload headers in aiohttp MultipartWriter/Payload | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4156: Malformed /FlateDecode in PDFs causes excessive runtimes in pypdf (DoS vulnerability) | secure-packages-26.05 | |
| In progress | Medium | GHSA-6hr6-w5qg-qmwg: h2 <=4.4.0 forwards multiple Host headers, enabling HTTP/2 to 1.1 request smuggling (CWE-444) | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-2113: AIOHTTP <3.14.1 fails to close payload on disconnect during write, causing resource starvation | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-2106: AIOHTTP pre-3.14.0 header injection allows request modification via multipart/payload headers | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-113: Use-after-free in Apache Arrow C++ IPC file pre-buffering with variadic buffers (15–23) | secure-packages-26.05 | |
| In progress | Medium | GHSA-gj48-438w-jh9v: Bleach clean/Cleaner fails to sanitize javascript: in formaction on submit controls | secure-packages-26.05 | |
| In progress | Critical | GHSA-jhr6-gm9c-rqjv: sentence-transformers import_module_class trust bypass via os.path.exists check enables arbitrary code execution | secure-packages-26.05 | |
| In progress | Medium | GHSA-42vr-xj54-vc7v: Deeply nested JWT payload causes pre-auth DoS via uncaught RecursionError in PyJWT | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3928: Tornado DoS: parse_qs without max_num_fields on form-urlencoded bodies stalls event loop | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-88: TemplateLookup.get_template() // URI path traversal in Mako <1.3.11 enables arbitrary file read | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-3967: PyTorch Lightning <=2.6.5 RCE via load_from_checkpoint _instantiator import bypassing weights_only | secure-packages-26.05 | |
| In progress | Low | PYSEC-2026-3040: parse_form accepts negative Content-Length, causing unbounded EOF read and whole body buffering | secure-packages-26.05 | |
| In progress | Medium | PYSEC-2026-3943: WebOb open redirect: urljoin strips leading control characters/spaces, bypassing checks and enabling off-host | secure-packages-26.05 | |
| In progress | High | GHSA-x78j-v8h9-3j2q: virtualenv activate.bat command injection via unescaped prompt on Windows | secure-packages-26.05 | |
| In progress | High | PYSEC-2026-4057: JupyterLab 4.5.0–4.6.3 clipboard paste executes scripts via trusted cell outputs | secure-packages-26.05 |