Security Digest · page 1 of 5
Critical PyPI advisories
451 critical advisories for PyPI packages since October 2023, newest first. Check your project with pip-audit (or: pip show <package>).
- Pillow: Argument Injection in Ghostscript call, potentially leading into RCE CVE-2026-112900 CVSS 9.2 Critical
Pillow>= 2.6.0, < 13.0.0 → fixed in 13.0.0 - Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO CVE-2026-112393 CVSS 9.2 Critical
Pillow>= 2.0.0, < 13.0.0 → fixed in 13.0.0 - uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised GHSA-hq85-5cpj-mr62 CVSS 9.1 Critical
uv< 0.13.4 → fixed in 0.13.4 - Pillow: Heap buffer overflow in ImagingJpegDecode CVE-2026-112403 CVSS 9.2 Critical
Pillow<= 12.3.0 → fixed in 13.0.0 - certifi bundles emSign root CAs with compromised intermediate CA keys GHSA-6q48-6c7w-9gw2 CVSS 9.1 Critical
certifi>= 2019.03.09, < 2026.10.19 → fixed in 2026.10.19 - Mercury: Unauthenticated Remote Code Execution via /api/kernels CVE-2026-111058 CVSS 9.8 Critical
mercury<= 3.2.5 → fixed in 3.2.6 - Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass CVE-2026-111057 CVSS 10.0 Critical
mercury>= 3.0.0, <= 3.2.3 → fixed in 3.2.4 - LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport CVE-2026-105192 CVSS 9.8 Critical
lmcache>= 0.3.9, < 0.5.6 → fixed in 0.5.6 - Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution CVE-2026-96620 CVSS 9.2 Critical
claude-agent-sdk< 0.2.121 → fixed in 0.2.121 - PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls CVE-2026-61445 CVSS 9.9 Critical
praisonai<= 4.6.77 → fixed in 4.6.78 - PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets CVE-2026-61447 CVSS 10.0 Critical
praisonaiagents<= 1.6.77 → fixed in 1.6.78 - Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration CVE-2026-105697 CVSS 9.9 Critical
langflow>= 1.1.2, < 1.10.3 → fixed in 1.10.3;langflow-base>= 0.1.2, < 0.10.3 → fixed in 0.10.3;lfx< 1.10.3 → fixed in 1.10.3 - PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation CVE-2026-62176 CVSS 9.1 Critical
PraisonAI<= 4.6.77 → fixed in 4.6.78 - Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation CVE-2026-10561 CVSS 9.9 Critical
langflow< 1.10.1 → fixed in 1.10.1 - Langflow: Weak Fernet Key via random.seed() CVE-2026-9205 CVSS 9.1 Critical
langflow<= 1.10.0 → fixed in 1.10.1 - Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass CVE-2026-8505 CVSS 9.8 Critical
langflow>= 1.7.0, <= 1.9.0 → fixed in 1.9.1 - Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain GHSA-v2f8-6655-7grj CVSS 10.0 Critical
vibe-trading-ai>= 0.1.0, < 0.1.7 → fixed in 0.1.7 - Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF GHSA-jqmf-mx4f-hfr6 CVSS 10.0 Critical
vibe-trading-ai>= 0.1.0, < 0.1.7 → fixed in 0.1.7 - PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard CVE-2026-102268 CVSS 9.1 Critical
PyJWT<= 2.13.0 → fixed in 2.14.0 - Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context CVE-2026-61732 CVSS 10.0 Critical
decepticon-core<= 1.1.16 → fixed in 1.1.17;decepticon<= 1.1.16 → fixed in 1.1.17;decepticon-sdk<= 1.1.16 → fixed in 1.1.17 - plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection CVE-2026-57149 CVSS 9.9 Critical
plone.app.portlets>= 7.0.0, <= 7.0.1 → fixed in 7.0.2;plone.app.portlets>= 6.0.0, <= 6.0.3 → fixed in 6.0.4;plone.app.portlets>= 5.0.0, <= 5.0.7 → fixed in 5.0.8 - Home Assistant: XSS in Statistics Graph Card CVE-2026-91130 CVSS 9.3 Critical
homeassistant< 2026.7.0 → fixed in 2026.7.0 - [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token CVE-2026-77244 CVSS 10.0 Critical
mcp-atlassian< 0.22.0 → fixed in 0.22.0 - lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks CVE-2026-85734 CVSS 9.1 Critical
lightrag-hku< 1.5.5 → fixed in 1.5.5 - Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass CVE-2026-59163 CVSS 9.1 Critical
mnemosyne-memory<= 3.10.0 → fixed in 3.10.1 - AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing CVE-2026-63374 CVSS 9.3 Critical
anyio< 4.14.2 → fixed in 4.14.2 - LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py CVE-2025-66455 CVSS 9.8 Critical
lmdeploy>= 0.9.2, < 0.16.0 → fixed in 0.16.0 - djust has an authorization bypass on the WebSocket/SSE mount path CVE-2026-61594 CVSS 9.1 Critical
djust< 1.0.7 → fixed in 1.0.7 - LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy CVE-2025-59953 CVSS 9.8 Critical
lmdeploy>= 0.9.1, < 0.10.2 → fixed in 0.10.2 - ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade CVE-2026-59178 CVSS 9.8 Critical
esphome-device-builder< 1.0.12 → fixed in 1.0.12 - MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) CVE-2026-59971 CVSS 10.0 Critical
mysql-mcp-server< 0.4.2 → fixed in 0.4.2 - Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover CVE-2026-59151 CVSS 9.6 Critical
prowler-cloud< 5.30.3 → fixed in 5.30.3 - NLTK: Allowlisted pickle loaders still permit code execution in current source CVE-2026-79657 CVSS 9.3 Critical
nltk<= 3.10.2 → fixed in 3.10.3 - NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution CVE-2026-78683 CVSS 9.4 Critical
nltk<= 3.9.4 → fixed in 3.10.0 - GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated… CVE-2026-78676 CVSS 9.3 Critical
GitPython<= 3.1.58 → fixed in 3.1.59 - unstructured: Server-Side Request Forgery in the URL-based partitioning CVE-2026-71428 CVSS 9.3 Critical
unstructured>= 0.4.7, < 0.24.0 → fixed in 0.24.0 - python-jose algorithm confusion guard bypassed by DER-encoded public keys CVE-2026-85394 CVSS 9.3 Critical
python-jose<= 3.5.0 → no fix listed - Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE CVE-2026-62674 CVSS 9.0 Critical
omnigent< 0.3.0 → fixed in 0.3.0 - NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) CVE-2026-79675 CVSS 9.3 Critical
nltk<= 3.10.2 → fixed in 3.10.3 - plone.app.portlets vulnerable to denial of service via RSS feed portlet CVE-2026-55248 CVSS 9.1 Critical
plone.app.portlets>= 7.0.0, <= 7.0.1 → fixed in 7.0.2;plone.app.portlets>= 6.0.0, < 6.0.4 → fixed in 6.0.4;plone.app.portlets< 5.0.8 → fixed in 5.0.8 - plone.app.event vulnerable to denial of service via iCalendar import CVE-2026-55247 CVSS 9.1 Critical
plone.app.event< 5.2.4 → fixed in 5.2.4;plone.app.event>= 6.0.0a1, < 6.0.1 → fixed in 6.0.1 - LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint CVE-2026-37004 CVSS 9.8 Critical
litellm< 1.83.7 → fixed in 1.83.7 - senaite.core Vulnerable to Eval Injection and Missing Authorization CVE-2026-54569 CVSS 9.8 Critical
senaite.core>= 2.0.0, <= 2.6.0 → no fix listed - Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise) GHSA-93qj-5q5v-3c2h
pantheon-agents>= 0.6.1, <= 0.6.2 → fixed in 0.6.4 - Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution CVE-2026-45018 CVSS 9.8 Critical
chainlit>= 2.4.0rc0, <= 2.11.1 → fixed in 2.12.0 - qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input CVE-2026-55546 CVSS 9.8 Critical
qwed-mcp< 0.2.1 → fixed in 0.2.1 - nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset (… CVE-2026-55640 CVSS 9.1 Critical
nextcloud-mcp-server<= 0.117.1 → fixed in 0.117.2 - PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 /… CVE-2026-55536 CVSS 9.1 Critical
PraisonAI< 4.6.58 → fixed in 4.6.58 - mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server CVE-2026-53710 CVSS 10.0 Critical
mcp-contextforge-gateway<= 1.0.1 → fixed in 1.0.2 - Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing CVE-2026-61539 CVSS 10.0 Critical
xinference<= 2.5.0 → fixed in 2.7.0 - surfio has an out-of-bounds read CVE-2026-55211 CVSS 9.8 Critical
surfio< 0.0.19 → fixed in 0.0.19 - resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read CVE-2026-55209 CVSS 9.8 Critical
resdata< 6.2.9 → fixed in 6.2.9 - MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS… CVE-2026-64849 CVSS 9.3 Critical
mlflow>= 3.3.0, < 3.15.0 → fixed in 3.15.0 - sentence-transformers local model loading bypasses trust_remote_code and executes custom Python CVE-2026-68770 CVSS 9.3 Critical
sentence-transformers< 5.6.0 → fixed in 5.6.0 - Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration CVE-2026-67426 CVSS 9.3 Critical
flyto-core>= 2.26.6, < 2.26.7 → fixed in 2.26.7 - Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) CVE-2026-67429 CVSS 10.0 Critical
flyto-core< 2.26.7 → fixed in 2.26.7 - Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding CVE-2026-64825 CVSS 9.0 Critical
homeassistant< 2026.6.0 → fixed in 2026.6.0 - LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection CVE-2026-61740 CVSS 9.3 Critical
lightrag-hku< 1.5.4 → fixed in 1.5.4 - LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests CVE-2026-61736 CVSS 9.3 Critical
lightrag-hku<= 1.5.3 → fixed in 1.5.4 - Snowflake Connector for Python improperly verifies TLS hostnames CVE-2026-15925 CVSS 9.2 Critical
snowflake-connector-python< 3.18.1 → fixed in 3.18.1;snowflake-connector-python>= 4.0.0, < 4.7.1 → fixed in 4.7.1 - GPT Researcher MCP STDIO configuration allows remote command execution CVE-2025-65720 CVSS 9.8 Critical
gpt-researcher>= 0.14.5, <= 0.14.7 → no fix listed - DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval CVE-2026-61667 CVSS 9.9 Critical
DIRAC>= 6, < 8.0.79 → fixed in 8.0.79;DIRAC>= 8.1.0a1, < 9.0.22 → fixed in 9.0.22;DIRAC>= 9.1.0, < 9.1.10 → fixed in 9.1.10 - DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input CVE-2026-45579 CVSS 9.9 Critical
DIRAC>= 6, < 8.0.79 → fixed in 8.0.79;DIRAC>= 8.1.0a1, < 9.0.22 → fixed in 9.0.22;DIRAC>= 9.1.0, < 9.1.10 → fixed in 9.1.10 - mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials CVE-2026-61459 CVSS 9.3 Critical
mcp-server-kubernetes< 3.9.0 → fixed in 3.9.0 - Cognee allows non-superusers to overwrite global LLM configuration CVE-2026-58473 CVSS 9.3 Critical
cognee< 1.5.0 → fixed in 1.5.0 - Apache Airflow allows code execution through unsafe serialized DAG deserialization CVE-2026-33264 CVSS 9.8 Critical
apache-airflow< 3.3.0 → fixed in 3.3.0 - Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent CVE-2026-54769 CVSS 10.0 Critical
langroid<= 0.65.1 → fixed in 0.65.2 - Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls CVE-2026-54760 CVSS 9.3 Critical
langroid<= 0.65.0 → fixed in 0.65.1 - Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring… CVE-2026-55615 CVSS 9.2 Critical
langroid<= 0.65.4 → fixed in 0.65.5 - fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection CVE-2026-52830 CVSS 9.4 Critical
fast-mcp-telegram<= 0.19.0 → fixed in 0.19.1 - mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete CVE-2026-50027 CVSS 9.8 Critical
mcp-memory-service< 10.67.1 → fixed in 10.67.1 - Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication CVE-2026-48797 CVSS 9.3 Critical
backpropagate>= 1.1.0, < 1.2.0 → fixed in 1.2.0;@mcptoolshop/backpropagate>= 1.1.0, < 1.2.0 → fixed in 1.2.0 - semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin GHSA-98x5-vq43-vc5p
semantic-router>= 0.1.8, < 0.1.15 → fixed in 0.1.15 - mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind CVE-2026-49257 CVSS 10.0 Critical
mcp-pinot-server<= 3.0.1 → fixed in 3.1.0 - Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise CVE-2026-55166 CVSS 9.9 Critical
lemur< 1.9.2 → fixed in 1.9.2 - motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) GHSA-qxvg-h7q2-hcxh CVSS 9.8 Critical
motioneye< 0.44.0 → fixed in 0.44.0 - motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal GHSA-phv5-334h-mxcw CVSS 10.0 Critical
motioneye< 0.44.0 → fixed in 0.44.0 - motionEye: Authentication possible via password hash CVE-2026-46488 CVSS 9.1 Critical
motioneye< 0.44.0 → fixed in 0.44.0 - Chainlit contains a session hijacking vulnerability CVE-2026-56104 CVSS 9.1 Critical
chainlit< 2.10.1 → fixed in 2.10.1 - Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server CVE-2026-56265 CVSS 9.3 Critical
crawl4ai< 0.8.7 → fixed in 0.8.7 - Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit CVE-2026-55447 CVSS 9.6 Critical
langflow< 1.9.2 → fixed in 1.9.2 - PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints CVE-2026-57118 CVSS 9.8 Critical
praisonaiagents< 1.6.59 → fixed in 1.6.59 - PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in CVE-2026-57123 CVSS 9.8 Critical
praisonaiagents< 1.6.59 → fixed in 1.6.59 - python-statemachine SCXML <data expr> Eval Injection CVE-2026-47103 CVSS 9.3 Critical
python-statemachine>= 3.0.0, < 3.2.0 → fixed in 3.2.0 - Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args GHSA-r253-r9jw-qg44 CVSS 10.0 Critical
crawl4ai<= 0.8.9 → fixed in 0.9.0 - PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command… CVE-2026-57124 CVSS 9.8 Critical
praisonai<= 4.6.48 → fixed in 4.6.59 - praisonai: recipe serve auth middleware silently disables itself when no secret is set CVE-2026-57127 CVSS 9.8 Critical
praisonai<= 4.6.48 → fixed in 4.6.59 - netlicensing-mcp: REST Path Traversal Bypasses Token Redaction CVE-2026-57496 CVSS 9.6 Critical
netlicensing-mcp< 0.1.8 → fixed in 0.1.8 - PraisonAI: Jobs API exposes agent-execution endpoints with no authentication CVE-2026-57131 CVSS 9.8 Critical
praisonai< 4.6.59 → fixed in 4.6.59 - Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP CVE-2026-44727 CVSS 9.3 Critical
jupyter-server<= 2.19.0 → fixed in 2.20.0 - praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVE-2026-57148 CVSS 9.8 Critical
praisonai-platform<= 0.1.4 → fixed in 0.1.6 - praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVE-2026-57147 CVSS 9.8 Critical
praisonai-platform<= 0.1.4 → fixed in 0.1.6 - PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation CVE-2026-57116 CVSS 9.8 Critical
praisonai>= 4.2.1, <= 4.6.57 → fixed in 4.6.59 - PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass CVE-2026-57125 CVSS 9.8 Critical
praisonai<= 4.6.48 → fixed in 4.6.59;praisonaiagents< 1.6.59 → fixed in 1.6.59 - Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE GHSA-2jq4-q6vv-4cp3 CVSS 9.6 Critical
crawl4ai<= 0.8.9 → fixed in 0.9.0 - PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation CVE-2026-57145 CVSS 9.1 Critical
praisonai< 4.6.61 → fixed in 4.6.61 - Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak CVE-2026-55450 CVSS 9.3 Critical
langflow< 1.9.1 → fixed in 1.9.1 - Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory CVE-2026-50203 CVSS 9.1 Critical
apache-airflow-providers-sftp< 5.8.1 → fixed in 5.8.1 - Langflow: Unauthenticated RCE in Shareable Playgrounds CVE-2026-48519 CVSS 9.6 Critical
langflow<= 1.9.1 → fixed in 1.9.2 - Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API CVE-2026-53753 CVSS 9.8 Critical
crawl4ai<= 0.8.6 → fixed in 0.8.7