Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive …

▾ Twilightkeras · kerasEPSS 0.56%via OSV

MAL-2026-5545None

5mo ago

Malicious code in acme-widget-layout-utils (PyPI)

▾ Sunlitacme-widget-layout-utils · acme-widget-layout-utilsvia OSV

CVE-2026-48045Medium· 6.5

5mo ago

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

▾ Sunlitzeroconf · zeroconfEPSS 0.37%via GHSA

CVE-2026-10143High· 7.5

5mo ago

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration c…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration c…

▾ Twilightdpkp · kafka-pythonEPSS 0.52%via NVD

CVE-2026-10142High· 7.5

5mo ago

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length…

▾ Twilightdpkp · kafka-pythonEPSS 0.35%via NVD

CVE-2026-42563High· 8.0

5mo ago

dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge (CVE-2026-42563)

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the …

▾ TwilightRed Hat · Red Hat Ansible Automation Platform 2EPSS 0.56%via CSAF

CVE-2026-42305High· 8.8

5mo ago

dulwich: Dulwich: Remote Code Execution via Malicious Git Repository (CVE-2026-42305)

A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious …

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.64%via CSAF

CVE-2026-44716High· 7.5

5mo ago

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat…

▾ Twilightpipecat · pipecatEPSS 0.42%via NVD

MAL-2026-5531None

5mo ago

Malicious code in telegramlite (PyPI)

▾ Sunlittelegramlite · telegramlitevia OSV

Tagged “pip”

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aiohttp: Incomplete websocket frame payloads bypass memory limits

Vulnerable OpenSSL included in cryptography wheels

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Malicious code in bash8 (PyPI)

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

ChromaDB has a code injection vulnerability

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

Malicious code in nagios-xi (PyPI)

Tornado has out-of-bounds memory access via C extension

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/f…

Malicious code in acme-widget-layout-utils (PyPI)

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration c…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length…

dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge (CVE-2026-42563)

dulwich: Dulwich: Remote Code Execution via Malicious Git Repository (CVE-2026-42305)

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents

Malicious code in telegramlite (PyPI)