Security Digest · page 2 of 5
Critical PyPI advisories (page 2)
451 critical advisories for PyPI packages since October 2023, newest first. Check your project with pip-audit (or: pip show <package>).
- vLLM: OpenAI auth bypass CVE-2026-48746 CVSS 9.1 Critical
vllm>= 0.3.0, < 0.22.0 → fixed in 0.22.0 - LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-49468 CVSS 9.5 Critical
litellm< 1.84.0 → fixed in 1.84.0 - Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution CVE-2026-56266 CVSS 9.2 Critical
crawl4ai<= 0.8.6 → fixed in 0.8.7 - ChromaDB has a code injection vulnerability CVE-2026-45833 CVSS 9.4 Critical
chromadb>= 0.4.17, <= 1.5.9 → no fix listed - Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token CVE-2026-48039 CVSS 9.1 Critical
meta-ads-mcp<= 1.0.108 → fixed in 1.0.109 - NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated… CVE-2026-47731 CVSS 9.1 Critical
ait-core= 3.1.0 → fixed in 3.1.1;ait-core< 2.6.1 → fixed in 2.6.1 - MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper CVE-2026-47708 CVSS 9.3 Critical
stata-mcp< 1.17.3 → fixed in 1.17.3 - MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration CVE-2026-4035 CVSS 9.1 Critical
mlflow< 3.11.0 → fixed in 3.11.0 - Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution CVE-2026-44181 CVSS 10.0 Critical
jupyter_enterprise_gateway>= 2.0.0rc2, < 3.3.0 → fixed in 3.3.0 - Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass CVE-2026-44180 CVSS 9.8 Critical
jupyter_enterprise_gateway>= 2.0.0rc1, < 3.3.0 → fixed in 3.3.0 - Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering CVE-2026-44182 CVSS 10.0 Critical
jupyter_enterprise_gateway< 3.3.0 → fixed in 3.3.0 - OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed CVE-2026-41283 CVSS 9.9 Critical
mistral>= 20.0.0, < 20.1.1 → fixed in 20.1.1;mistral= 21.0.0 → no fix listed;mistral= 22.0.0 → no fix listed - OpenMed vulnerable to remote code injection through privacy-filter model loading path CVE-2026-47117 CVSS 9.3 Critical
openmed< 1.5.2 → fixed in 1.5.2 - Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine CVE-2026-42252 CVSS 9.1 Critical
apache-airflow>= 3.0.0, < 3.2.2 → fixed in 3.2.2 - praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members CVE-2026-47413 CVSS 9.6 Critical
praisonai-platform< 0.1.4 → fixed in 0.1.4 - PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution CVE-2026-47391 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation GHSA-jmfc-hfjq-pxcp CVSS 9.1 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation CVE-2026-47407 CVSS 9.4 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback GHSA-fp6w-8wpg-74g5 CVSS 9.2 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} CVE-2026-47416 CVSS 9.6 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - stigmem-node's federation peer registration lacked explicit out-of-band approval GHSA-9vp8-3hmv-8fgh CVSS 9.1 Critical
stigmem-node< 0.9.0a2 → fixed in 0.9.0a2 - PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset CVE-2026-47396 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default CVE-2026-47393 CVSS 9.8 Critical
PraisonAI<= 4.6.39 → fixed in 4.6.40 - PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) CVE-2026-47392 CVSS 9.9 Critical
praisonaiagents<= 1.6.39 → fixed in 1.6.40;PraisonAI<= 4.6.39 → fixed in 4.6.40 - praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is… CVE-2026-47410 CVSS 9.8 Critical
praisonai-platform<= 0.1.2 → fixed in 0.1.4 - amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection CVE-2026-8838 CVSS 9.3 Critical
redshift-connector<= 2.1.13 → fixed in 2.1.14 - Langroid has Prompt to SQL Injection, Leading to RCE CVE-2026-25879 CVSS 9.8 Critical
langroid< 0.63.0 → fixed in 0.63.0 - MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled CVE-2026-2651 CVSS 9.0 Critical
mlflow< 3.10.0 → fixed in 3.10.0 - Apache Fory PyFory Deserialization of Untrusted Data CVE-2026-48207 CVSS 9.8 Critical
pyfory>= 0.13.0, < 1.0.0 → fixed in 1.0.0 - BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46695 CVSS 10.0 Critical
boxlite< 0.9.0 → fixed in 0.9.0;@boxlite-ai/boxlite< 0.9.0 → fixed in 0.9.0;github.com/boxlite-ai/boxlite/sdks/go< 0.9.0 → fixed in 0.9.0; +2 more packages - Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46703 CVSS 9.6 Critical
boxlite< 0.9.0 → fixed in 0.9.0;boxlite-cli< 0.9.0 → fixed in 0.9.0;boxlite< 0.9.0 → fixed in 0.9.0; +2 more packages - Malicious code in guardrails-ai 0.10.1 (supply chain compromise) CVE-2026-45758 CVSS 9.6 Critical
guardrails-ai= 0.10.1 → no fix listed - rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CVE-2026-45568 CVSS 9.9 Critical
zrok>= 0.4.47, <= 1.1.11 → no fix listed - APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization CVE-2026-31072 CVSS 9.8 Critical
apscheduler>= 4.0.0a1, <= 4.0.0a6 → no fix listed - MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution CVE-2026-2611 CVSS 9.6 Critical
mlflow= 3.9.0 → fixed in 3.10.0 - Malicious dropper in mistralai 2.4.6 PyPI package GHSA-wx9m-wx4f-4cmg CVSS 9.6 Critical
mistralai= 2.4.6 → no fix listed - SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability CVE-2026-7302 CVSS 9.1 Critical
sglang>= 0.5.5, <= 0.5.12 → no fix listed - SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket CVE-2026-7301 CVSS 9.8 Critical
sglang>= 0.5.5, <= 0.5.12 → no fix listed - ChromaDB Python project has a pre-authentication code injection vulnerability CVE-2026-45829 CVSS 9.3 Critical
chromadb>= 1.0.0, <= 1.5.9 → no fix listed - SGLang: Unauthenticated RCE via --enable-custom-logit-processor CVE-2026-7304 CVSS 9.8 Critical
sglang>= 0.4.1.post7, <= 0.5.12 → no fix listed - utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol CVE-2026-45369 CVSS 10.0 Critical
utcp-cli<= 1.1.1 → fixed in 1.1.2 - Ludwig framework is vulnerable to insecure deserialization in its model serving component CVE-2026-31238 CVSS 9.8 Critical
ludwig<= 0.10.4 → no fix listed - Ludwig framework is vulnerable to insecure deserialization through its predict() method. CVE-2026-31237 CVSS 9.8 Critical
ludwig<= 0.10.4 → no fix listed - Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism CVE-2026-31233 CVSS 9.8 Critical
guardrails-ai<= 0.6.7 → no fix listed - mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub CVE-2026-31239 CVSS 9.8 Critical
mamba-ssm<= 2.2.6 → no fix listed - Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component CVE-2026-31234 CVSS 9.8 Critical
horovod<= 0.28.1 → no fix listed - imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module CVE-2026-31235 CVSS 9.8 Critical
imgaug<= 0.4.0 → no fix listed - llm CLI tool contains a code injection vulnerability via `--functions` command-line argument CVE-2026-31236 CVSS 9.8 Critical
llm<= 0.27.1 → no fix listed - PySyft server-side arbitrary Python execution after code approval CVE-2026-31220 CVSS 9.8 Critical
syft<= 0.9.5 → no fix listed - Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page CVE-2025-65719 CVSS 9.8 Critical
kubectl-mcp-server< 1.2.0 → fixed in 1.2.0;kubectl-mcp-server< 1.2.0 → fixed in 1.2.0 - pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and… CVE-2026-7813 CVSS 9.4 Critical
pgadmin4< 9.15 → fixed in 9.15 - PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection CVE-2026-44336 CVSS 9.4 Critical
PraisonAI<= 4.6.33 → fixed in 4.6.34 - dash-uploader has a directory traversal vulnerability CVE-2026-38360 CVSS 9.8 Critical
dash-uploader>= 0.1.0, <= 0.7.0a2 → no fix listed - Open WebUI has an LDAP Empty Password Authentication Bypass CVE-2026-44551 CVSS 9.1 Critical
open-webui<= 0.8.12 → fixed in 0.9.0 - Compromise of PyTorch Lightning PyPi Package Versions CVE-2026-44484 CVSS 9.3 Critical
pytorch-lightning= 2.6.2 → no fix listed;pytorch-lightning= 2.6.3 → no fix listed - Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API CVE-2026-29080 CVSS 9.4 Critical
rucio>= 1.27.0, < 35.8.5 → fixed in 35.8.5;rucio>= 36.0.0, < 38.5.5 → fixed in 38.5.5;rucio>= 39.0.0, < 39.4.2 → fixed in 39.4.2; +1 more packages - wger: cross-tenant password reset and plaintext disclosure via gym=None bypass CVE-2026-43948 CVSS 9.9 Critical
wger<= 2.5 → fixed in 2.6 - misp-modules website - Missing CSRF protection in the website home blueprint CVE-2026-44364 CVSS 9.3 Critical
misp-modules<= 3.0.7 → no fix listed - Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API CVE-2026-29090 CVSS 9.0 Critical
rucio>= 1.30.0, < 35.8.5 → fixed in 35.8.5;rucio>= 36.0.0, < 38.5.5 → fixed in 38.5.5;rucio>= 39.0.0, < 39.4.2 → fixed in 39.4.2; +1 more packages - FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft CVE-2026-42864 CVSS 9.9 Critical
firefighter-incident< 0.0.54 → fixed in 0.0.54 - Langflow Knowledge Bases API is Vulnerable to Path Traversal CVE-2026-42048 CVSS 9.6 Critical
langflow<= 1.8.4 → fixed in 1.9.0 - django-s3file is vulnerable to relative path traversal CVE-2026-42196 CVSS 9.9 Critical
django-s3file<= 7.0.1 → fixed in 7.0.2 - Codechecker has an authentication bypass for certain API calls CVE-2026-25660 CVSS 9.3 Critical
codechecker<= 6.27.3 → no fix listed - ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView CVE-2026-42601 CVSS 9.3 Critical
archivebox<= 0.8.6rc0 → no fix listed - Sentry's improper authentication on SAML SSO process allows user identity linking CVE-2026-42354 CVSS 9.1 Critical
sentry>= 21.12.0, <= 26.4.0 → fixed in 26.4.1 - NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system CVE-2026-24178 CVSS 9.8 Critical
nvflare< 2.7.2 → fixed in 2.7.2 - LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208 CVSS 9.3 Critical
litellm>= 1.81.16, < 1.83.7 → fixed in 1.83.7 - Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer CVE-2025-62373 CVSS 9.8 Critical
pipecat-ai>= 0.0.41, < 0.0.94 → fixed in 0.0.94 - OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes CVE-2026-40525 CVSS 9.1 Critical
openviking< 0.3.9 → fixed in 0.3.9 - Sentry: Improper authentication on SAML SSO process allows user identity linking CVE-2026-27197 CVSS 9.1 Critical
sentry>= 21.12.0, < 26.2.0 → no fix listed - PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection CVE-2026-41497 CVSS 9.8 Critical
praisonai<= 4.5.148 → fixed in 4.5.149 - UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen CVE-2026-54334 CVSS 9.8 Critical
uefi-firmware<= 1.12 → no fix listed - Upsonic: remote code execution vulnerability in its MCP server/task creation functionality CVE-2026-30625 CVSS 9.8 Critical
upsonic< 0.72.0 → fixed in 0.72.0 - UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable CVE-2026-54333 CVSS 9.8 Critical
uefi-firmware<= 1.12 → no fix listed - Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability CVE-2026-4810 CVSS 9.3 Critical
google-adk>= 2.0.0a1, < 2.0.0a2 → fixed in 2.0.0a2;google-adk>= 1.7.0, < 1.28.1 → fixed in 1.28.1 - excel-mcp-server has a Path Traversal issue CVE-2026-40576 CVSS 9.4 Critical
excel-mcp-server<= 0.1.7 → fixed in 0.1.8 - PraisonAI has critical RCE via `type: job` workflow YAML CVE-2026-40288 CVSS 9.8 Critical
praisonaiagents<= 1.5.139 → fixed in 1.5.140;PraisonAI<= 4.5.138 → fixed in 4.5.139 - PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) CVE-2026-40111 CVSS 9.3 Critical
praisonaiagents<= 1.5.126 → fixed in 1.5.128 - PraisonAI Vulnerable Untrusted Remote Template Code Execution CVE-2026-40154 CVSS 9.3 Critical
PraisonAI< 4.5.128 → fixed in 4.5.128 - gramps-webapi: Zip Slip Path Traversal in Media Archive Import CVE-2026-40258 CVSS 9.1 Critical
gramps-webapi>= 1.6.0, <= 3.11.0 → fixed in 3.11.1 - aws-mcp has a Command Injection Remote Code Execution Vulnerability CVE-2026-5059 CVSS 9.8 Critical
aws-mcp<= 1.7.0 → no fix listed - PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack` CVE-2026-40157 CVSS 9.4 Critical
PraisonAI>= 2.7.2, < 4.5.128 → fixed in 4.5.128 - PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions CVE-2026-40289 CVSS 9.1 Critical
praisonaiagents<= 1.5.139 → fixed in 1.5.140;PraisonAI<= 4.5.138 → fixed in 4.5.139 - parisneo/lollms vulnerable to stored XSS in the social feature CVE-2026-1115 CVSS 9.6 Critical
lollms< 2.2.0 → fixed in 2.2.0 - ajenti.plugin.core has password bypass when 2FA is activated CVE-2026-40177 CVSS 9.1 Critical
ajenti.plugin.core< 0.112 → fixed in 0.112 - Apache Airflow: JWT token still valid after logout CVE-2025-57735 CVSS 9.1 Critical
apache-airflow>= 3.0.0, < 3.2.0 → fixed in 3.2.0 - PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) CVE-2026-39888 CVSS 9.9 Critical
praisonaiagents<= 1.5.114 → fixed in 1.5.115 - PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading CVE-2026-39890 CVSS 9.8 Critical
praisonai<= 4.5.114 → fixed in 4.5.115 - PraisonAI Vulnerable to OS Command Injection CVE-2026-40088 CVSS 9.6 Critical
PraisonAI< 4.5.121 → fixed in 4.5.121 - Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass CVE-2026-39987 CVSS 9.3 Critical
marimo< 0.23.0 → fixed in 0.23.0 - LoLLMs is vulnerable to Improper Access Control through weak secret key CVE-2026-1114 CVSS 9.8 Critical
lollms< 2.2.0 → fixed in 2.2.0 - changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering CVE-2026-35490 CVSS 9.8 Critical
changedetection.io<= 0.54.7 → fixed in 0.54.8 - PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator CVE-2026-39305 CVSS 9.0 Critical
PraisonAI<= 4.5.112 → fixed in 4.5.113 - PraisonAI Has Path Traversal in FileTools CVE-2026-35615 CVSS 9.2 Critical
PraisonAI<= 1.5.112 → fixed in 1.5.113 - LiteLLM: Authentication bypass via OIDC userinfo cache key collision CVE-2026-35030 CVSS 9.4 Critical
litellm< 1.83.0 → fixed in 1.83.0 - mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization CVE-2026-0545 CVSS 9.1 Critical
mlflow<= 3.10.1 → no fix listed - pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992) CVE-2026-35459 CVSS 9.3 Critical
pyload-ng<= 0.5.0b3.dev96 → no fix listed - pymetasploit3 vulnerable to command injection in console.run_module_with_output() CVE-2026-5463 CVSS 9.3 Critical
pymetasploit3<= 1.0.6 → no fix listed - Kedro has Arbitrary Code Execution via Malicious Logging Configuration CVE-2026-35171 CVSS 9.8 Critical
kedro< 1.3.0 → fixed in 1.3.0 - Agno is vulnerable to Eval Injection CVE-2026-35002 CVSS 9.3 Critical
agno< 2.3.24 → fixed in 2.3.24