IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_A…

▾ Midnightlangflow · langflowEPSS 0.87%via NVD

MAL-2026-10771None

3mo ago

Malicious code in trongridme (PyPI)

▾ Sunlittrongridme · trongridmevia OSV

GHSA-mfr4-mq8w-vmg6Medium· 6.6

3mo ago

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

▾ Sunlitproot-distro · proot-distrovia GHSA

CVE-2026-53598High· 7.5

3mo ago

Prompty: Arbitrary file read via file reference expansion

▾ Twilightprompty · promptyEPSS 1.3%via GHSA

MAL-2026-10770None

3mo ago

Malicious code in govpkg (PyPI)

▾ Sunlitgovpkg · govpkgvia OSV

GHSA-8rqh-vxpr-x77pMedium· 4.3

3mo ago

plone.restapi: Stored XSS by spoofing mime type

▾ Sunlitplone-restapi · plone-restapivia OSV

MAL-2026-10768None

3mo ago

Malicious code in trongridev (PyPI)

▾ Sunlittrongridev · trongridevvia OSV

CVE-2026-49852High· 7.5

3mo ago

joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)

A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null ver…

▾ TwilightRed Hat · Red Hat Hardened ImagesEPSS 0.17%via CSAF

CVE-2026-15925High· 7.4

3mo ago

snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname ve…

A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. This cou…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.18%via CSAF

MAL-2026-10760None

3mo ago

Malicious code in abseil-py (PyPI)

▾ Sunlitabseil-py · abseil-pyvia OSV

Tagged “pip”

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Malicious code in paperclip-ai (PyPI)

Malicious code in neroteam-v1 (PyPI)

Malicious code in vantrala (PyPI)

Malicious code in nemopush (PyPI)

Malicious code in kimitalk (PyPI)

Malicious code in kimichat (PyPI)

Malicious code in telebot-bot-run (PyPI)

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

vLLM denial of service via prompt embeds on M-RoPE models

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

Malicious code in data-parser-utils (PyPI)

Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend

Malicious code in tinkoff-cloud-apis-internal (PyPI)

Malicious code in python-devplatform-client (PyPI)

Malicious code in mlflow-ui (PyPI)

Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass

Malicious code in dwh-kafka-client (PyPI)

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow

Malicious code in trongridme (PyPI)

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

Prompty: Arbitrary file read via file reference expansion

Malicious code in govpkg (PyPI)

plone.restapi: Stored XSS by spoofing mime type

Malicious code in trongridev (PyPI)

joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)

snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname ve…

Malicious code in abseil-py (PyPI)