---
title: "Critical PyPI advisories (page 2)"
url: https://erroneo.us/security/ecosystem/pypi/2/
description: "All 451 critical GitHub-reviewed PyPI security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 2 of 5."
type: ecosystem
section: "Security Digest"
date_modified: 2026-06-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical PyPI advisories (page 2)

- 2026-06-16 [CVE-2026-48746](https://erroneo.us/security/cve/CVE-2026-48746/index.md) vLLM: OpenAI auth bypass — vllm >= 0.3.0, < 0.22.0 → 0.22.0
- 2026-06-16 [CVE-2026-49468](https://erroneo.us/security/cve/CVE-2026-49468/index.md) LiteLLM: Authentication Bypass via Host Header Injection — litellm < 1.84.0 → 1.84.0
- 2026-06-16 [CVE-2026-56266](https://erroneo.us/security/cve/CVE-2026-56266/index.md) Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution — crawl4ai <= 0.8.6 → 0.8.7
- 2026-06-12 [CVE-2026-45833](https://erroneo.us/security/cve/CVE-2026-45833/index.md) ChromaDB has a code injection vulnerability — chromadb >= 0.4.17, <= 1.5.9 → no fix
- 2026-06-11 [CVE-2026-48039](https://erroneo.us/security/cve/CVE-2026-48039/index.md) Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token — meta-ads-mcp <= 1.0.108 → 1.0.109
- 2026-06-05 [CVE-2026-47731](https://erroneo.us/security/cve/CVE-2026-47731/index.md) NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker) — ait-core = 3.1.0 → 3.1.1; ait-core < 2.6.1 → 2.6.1
- 2026-06-04 [CVE-2026-47708](https://erroneo.us/security/cve/CVE-2026-47708/index.md) MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper — stata-mcp < 1.17.3 → 1.17.3
- 2026-06-03 [CVE-2026-4035](https://erroneo.us/security/cve/CVE-2026-4035/index.md) MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration — mlflow < 3.11.0 → 3.11.0
- 2026-06-03 [CVE-2026-44181](https://erroneo.us/security/cve/CVE-2026-44181/index.md) Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution — jupyter_enterprise_gateway >= 2.0.0rc2, < 3.3.0 → 3.3.0
- 2026-06-03 [CVE-2026-44180](https://erroneo.us/security/cve/CVE-2026-44180/index.md) Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass — jupyter_enterprise_gateway >= 2.0.0rc1, < 3.3.0 → 3.3.0
- 2026-06-03 [CVE-2026-44182](https://erroneo.us/security/cve/CVE-2026-44182/index.md) Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering — jupyter_enterprise_gateway < 3.3.0 → 3.3.0
- 2026-06-03 [CVE-2026-41283](https://erroneo.us/security/cve/CVE-2026-41283/index.md) OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed — mistral >= 20.0.0, < 20.1.1 → 20.1.1; mistral = 21.0.0 → no fix; mistral = 22.0.0 → no fix
- 2026-06-02 [CVE-2026-47117](https://erroneo.us/security/cve/CVE-2026-47117/index.md) OpenMed vulnerable to remote code injection through privacy-filter model loading path — openmed < 1.5.2 → 1.5.2
- 2026-06-01 [CVE-2026-42252](https://erroneo.us/security/cve/CVE-2026-42252/index.md) Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine — apache-airflow >= 3.0.0, < 3.2.2 → 3.2.2
- 2026-06-01 [CVE-2026-47413](https://erroneo.us/security/cve/CVE-2026-47413/index.md) praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members — praisonai-platform < 0.1.4 → 0.1.4
- 2026-05-29 [CVE-2026-47391](https://erroneo.us/security/cve/CVE-2026-47391/index.md) PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution — PraisonAI <= 4.6.39 → 4.6.40
- 2026-05-29 [GHSA-jmfc-hfjq-pxcp](https://erroneo.us/security/ghsa/GHSA-jmfc-hfjq-pxcp/index.md) stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation — stigmem-node < 0.9.0a2 → 0.9.0a2
- 2026-05-29 [CVE-2026-47407](https://erroneo.us/security/cve/CVE-2026-47407/index.md) PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation — praisonai-platform <= 0.1.2 → 0.1.4
- 2026-05-29 [GHSA-fp6w-8wpg-74g5](https://erroneo.us/security/ghsa/GHSA-fp6w-8wpg-74g5/index.md) stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback — stigmem-node < 0.9.0a2 → 0.9.0a2
- 2026-05-29 [CVE-2026-47416](https://erroneo.us/security/cve/CVE-2026-47416/index.md) praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id} — praisonai-platform <= 0.1.2 → 0.1.4
- 2026-05-29 [GHSA-9vp8-3hmv-8fgh](https://erroneo.us/security/ghsa/GHSA-9vp8-3hmv-8fgh/index.md) stigmem-node's federation peer registration lacked explicit out-of-band approval — stigmem-node < 0.9.0a2 → 0.9.0a2
- 2026-05-29 [CVE-2026-47396](https://erroneo.us/security/cve/CVE-2026-47396/index.md) PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset — PraisonAI <= 4.6.39 → 4.6.40
- 2026-05-29 [CVE-2026-47393](https://erroneo.us/security/cve/CVE-2026-47393/index.md) PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default — PraisonAI <= 4.6.39 → 4.6.40
- 2026-05-29 [CVE-2026-47392](https://erroneo.us/security/cve/CVE-2026-47392/index.md) PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode) — praisonaiagents <= 1.6.39 → 1.6.40; PraisonAI <= 4.6.39 → 4.6.40
- 2026-05-29 [CVE-2026-47410](https://erroneo.us/security/cve/CVE-2026-47410/index.md) praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset — praisonai-platform <= 0.1.2 → 0.1.4
- 2026-05-29 [CVE-2026-8838](https://erroneo.us/security/cve/CVE-2026-8838/index.md) amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection — redshift-connector <= 2.1.13 → 2.1.14
- 2026-05-27 [CVE-2026-25879](https://erroneo.us/security/cve/CVE-2026-25879/index.md) Langroid has Prompt to SQL Injection, Leading to RCE — langroid < 0.63.0 → 0.63.0
- 2026-05-26 [CVE-2026-2651](https://erroneo.us/security/cve/CVE-2026-2651/index.md) MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled — mlflow < 3.10.0 → 3.10.0
- 2026-05-21 [CVE-2026-48207](https://erroneo.us/security/cve/CVE-2026-48207/index.md) Apache Fory PyFory Deserialization of Untrusted Data — pyfory >= 0.13.0, < 1.0.0 → 1.0.0
- 2026-05-21 [CVE-2026-46695](https://erroneo.us/security/cve/CVE-2026-46695/index.md) BoxLite: Permission Bypass Allows Modification of Read-Only Files — boxlite < 0.9.0 → 0.9.0; @boxlite-ai/boxlite < 0.9.0 → 0.9.0; github.com/boxlite-ai/boxlite/sdks/go < 0.9.0 → 0.9.0
- 2026-05-21 [CVE-2026-46703](https://erroneo.us/security/cve/CVE-2026-46703/index.md) Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host — boxlite < 0.9.0 → 0.9.0; boxlite-cli < 0.9.0 → 0.9.0; boxlite < 0.9.0 → 0.9.0
- 2026-05-19 [CVE-2026-45758](https://erroneo.us/security/cve/CVE-2026-45758/index.md) Malicious code in guardrails-ai 0.10.1 (supply chain compromise) — guardrails-ai = 0.10.1 → no fix
- 2026-05-19 [CVE-2026-45568](https://erroneo.us/security/cve/CVE-2026-45568/index.md) rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths — zrok >= 0.4.47, <= 1.1.11 → no fix
- 2026-05-19 [CVE-2026-31072](https://erroneo.us/security/cve/CVE-2026-31072/index.md) APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization — apscheduler >= 4.0.0a1, <= 4.0.0a6 → no fix
- 2026-05-19 [CVE-2026-2611](https://erroneo.us/security/cve/CVE-2026-2611/index.md) MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution — mlflow = 3.9.0 → 3.10.0
- 2026-05-18 [GHSA-wx9m-wx4f-4cmg](https://erroneo.us/security/ghsa/GHSA-wx9m-wx4f-4cmg/index.md) Malicious dropper in mistralai 2.4.6 PyPI package — mistralai = 2.4.6 → no fix
- 2026-05-18 [CVE-2026-7302](https://erroneo.us/security/cve/CVE-2026-7302/index.md) SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability — sglang >= 0.5.5, <= 0.5.12 → no fix
- 2026-05-18 [CVE-2026-7301](https://erroneo.us/security/cve/CVE-2026-7301/index.md) SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket — sglang >= 0.5.5, <= 0.5.12 → no fix
- 2026-05-18 [CVE-2026-45829](https://erroneo.us/security/cve/CVE-2026-45829/index.md) ChromaDB Python project has a pre-authentication code injection vulnerability — chromadb >= 1.0.0, <= 1.5.9 → no fix
- 2026-05-18 [CVE-2026-7304](https://erroneo.us/security/cve/CVE-2026-7304/index.md) SGLang: Unauthenticated RCE via --enable-custom-logit-processor — sglang >= 0.4.1.post7, <= 0.5.12 → no fix
- 2026-05-14 [CVE-2026-45369](https://erroneo.us/security/cve/CVE-2026-45369/index.md) utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol — utcp-cli <= 1.1.1 → 1.1.2
- 2026-05-12 [CVE-2026-31238](https://erroneo.us/security/cve/CVE-2026-31238/index.md) Ludwig framework is vulnerable to insecure deserialization in its model serving component — ludwig <= 0.10.4 → no fix
- 2026-05-12 [CVE-2026-31237](https://erroneo.us/security/cve/CVE-2026-31237/index.md) Ludwig framework is vulnerable to insecure deserialization through its predict() method. — ludwig <= 0.10.4 → no fix
- 2026-05-12 [CVE-2026-31233](https://erroneo.us/security/cve/CVE-2026-31233/index.md) Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism — guardrails-ai <= 0.6.7 → no fix
- 2026-05-12 [CVE-2026-31239](https://erroneo.us/security/cve/CVE-2026-31239/index.md) mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub — mamba-ssm <= 2.2.6 → no fix
- 2026-05-12 [CVE-2026-31234](https://erroneo.us/security/cve/CVE-2026-31234/index.md) Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component — horovod <= 0.28.1 → no fix
- 2026-05-12 [CVE-2026-31235](https://erroneo.us/security/cve/CVE-2026-31235/index.md) imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module — imgaug <= 0.4.0 → no fix
- 2026-05-12 [CVE-2026-31236](https://erroneo.us/security/cve/CVE-2026-31236/index.md) llm CLI tool contains a code injection vulnerability via `--functions` command-line argument — llm <= 0.27.1 → no fix
- 2026-05-12 [CVE-2026-31220](https://erroneo.us/security/cve/CVE-2026-31220/index.md) PySyft server-side arbitrary Python execution after code approval — syft <= 0.9.5 → no fix
- 2026-05-12 [CVE-2025-65719](https://erroneo.us/security/cve/CVE-2025-65719/index.md) Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page — kubectl-mcp-server < 1.2.0 → 1.2.0; kubectl-mcp-server < 1.2.0 → 1.2.0
- 2026-05-11 [CVE-2026-7813](https://erroneo.us/security/cve/CVE-2026-7813/index.md) pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules — pgadmin4 < 9.15 → 9.15
- 2026-05-11 [CVE-2026-44336](https://erroneo.us/security/cve/CVE-2026-44336/index.md) PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection — PraisonAI <= 4.6.33 → 4.6.34
- 2026-05-08 [CVE-2026-38360](https://erroneo.us/security/cve/CVE-2026-38360/index.md) dash-uploader has a directory traversal vulnerability — dash-uploader >= 0.1.0, <= 0.7.0a2 → no fix
- 2026-05-08 [CVE-2026-44551](https://erroneo.us/security/cve/CVE-2026-44551/index.md) Open WebUI has an LDAP Empty Password Authentication Bypass — open-webui <= 0.8.12 → 0.9.0
- 2026-05-06 [CVE-2026-44484](https://erroneo.us/security/cve/CVE-2026-44484/index.md) Compromise of PyTorch Lightning PyPi Package Versions — pytorch-lightning = 2.6.2 → no fix; pytorch-lightning = 2.6.3 → no fix
- 2026-05-06 [CVE-2026-29080](https://erroneo.us/security/cve/CVE-2026-29080/index.md) Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API — rucio >= 1.27.0, < 35.8.5 → 35.8.5; rucio >= 36.0.0, < 38.5.5 → 38.5.5; rucio >= 39.0.0, < 39.4.2 → 39.4.2
- 2026-05-06 [CVE-2026-43948](https://erroneo.us/security/cve/CVE-2026-43948/index.md) wger: cross-tenant password reset and plaintext disclosure via gym=None bypass — wger <= 2.5 → 2.6
- 2026-05-06 [CVE-2026-44364](https://erroneo.us/security/cve/CVE-2026-44364/index.md) misp-modules website - Missing CSRF protection in the website home blueprint — misp-modules <= 3.0.7 → no fix
- 2026-05-06 [CVE-2026-29090](https://erroneo.us/security/cve/CVE-2026-29090/index.md) Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API — rucio >= 1.30.0, < 35.8.5 → 35.8.5; rucio >= 36.0.0, < 38.5.5 → 38.5.5; rucio >= 39.0.0, < 39.4.2 → 39.4.2
- 2026-05-05 [CVE-2026-42864](https://erroneo.us/security/cve/CVE-2026-42864/index.md) FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft — firefighter-incident < 0.0.54 → 0.0.54
- 2026-05-05 [CVE-2026-42048](https://erroneo.us/security/cve/CVE-2026-42048/index.md) Langflow Knowledge Bases API is Vulnerable to Path Traversal — langflow <= 1.8.4 → 1.9.0
- 2026-05-05 [CVE-2026-42196](https://erroneo.us/security/cve/CVE-2026-42196/index.md) django-s3file is vulnerable to relative path traversal — django-s3file <= 7.0.1 → 7.0.2
- 2026-05-05 [CVE-2026-25660](https://erroneo.us/security/cve/CVE-2026-25660/index.md) Codechecker has an authentication bypass for certain API calls — codechecker <= 6.27.3 → no fix
- 2026-05-04 [CVE-2026-42601](https://erroneo.us/security/cve/CVE-2026-42601/index.md) ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView — archivebox <= 0.8.6rc0 → no fix
- 2026-04-30 [CVE-2026-42354](https://erroneo.us/security/cve/CVE-2026-42354/index.md) Sentry's improper authentication on SAML SSO process allows user identity linking — sentry >= 21.12.0, <= 26.4.0 → 26.4.1
- 2026-04-28 [CVE-2026-24178](https://erroneo.us/security/cve/CVE-2026-24178/index.md) NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system — nvflare < 2.7.2 → 2.7.2
- 2026-04-24 [CVE-2026-42208](https://erroneo.us/security/cve/CVE-2026-42208/index.md) LiteLLM has SQL Injection in Proxy API key verification — litellm >= 1.81.16, < 1.83.7 → 1.83.7
- 2026-04-23 [CVE-2025-62373](https://erroneo.us/security/cve/CVE-2025-62373/index.md) Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer — pipecat-ai >= 0.0.41, < 0.0.94 → 0.0.94
- 2026-04-17 [CVE-2026-40525](https://erroneo.us/security/cve/CVE-2026-40525/index.md) OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes — openviking < 0.3.9 → 0.3.9
- 2026-04-17 [CVE-2026-27197](https://erroneo.us/security/cve/CVE-2026-27197/index.md) Sentry: Improper authentication on SAML SSO process allows user identity linking — sentry >= 21.12.0, < 26.2.0 → no fix
- 2026-04-17 [CVE-2026-41497](https://erroneo.us/security/cve/CVE-2026-41497/index.md) PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection — praisonai <= 4.5.148 → 4.5.149
- 2026-04-15 [CVE-2026-54334](https://erroneo.us/security/cve/CVE-2026-54334/index.md) UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen — uefi-firmware <= 1.12 → no fix
- 2026-04-15 [CVE-2026-30625](https://erroneo.us/security/cve/CVE-2026-30625/index.md) Upsonic: remote code execution vulnerability in its MCP server/task creation functionality — upsonic < 0.72.0 → 0.72.0
- 2026-04-15 [CVE-2026-54333](https://erroneo.us/security/cve/CVE-2026-54333/index.md) UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable — uefi-firmware <= 1.12 → no fix
- 2026-04-13 [CVE-2026-4810](https://erroneo.us/security/cve/CVE-2026-4810/index.md) Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability — google-adk >= 2.0.0a1, < 2.0.0a2 → 2.0.0a2; google-adk >= 1.7.0, < 1.28.1 → 1.28.1
- 2026-04-13 [CVE-2026-40576](https://erroneo.us/security/cve/CVE-2026-40576/index.md) excel-mcp-server has a Path Traversal issue — excel-mcp-server <= 0.1.7 → 0.1.8
- 2026-04-10 [CVE-2026-40288](https://erroneo.us/security/cve/CVE-2026-40288/index.md) PraisonAI has critical RCE via `type: job` workflow YAML — praisonaiagents <= 1.5.139 → 1.5.140; PraisonAI <= 4.5.138 → 4.5.139
- 2026-04-10 [CVE-2026-40111](https://erroneo.us/security/cve/CVE-2026-40111/index.md) PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) — praisonaiagents <= 1.5.126 → 1.5.128
- 2026-04-10 [CVE-2026-40154](https://erroneo.us/security/cve/CVE-2026-40154/index.md) PraisonAI Vulnerable Untrusted Remote Template Code Execution — PraisonAI < 4.5.128 → 4.5.128
- 2026-04-10 [CVE-2026-40258](https://erroneo.us/security/cve/CVE-2026-40258/index.md) gramps-webapi: Zip Slip Path Traversal in Media Archive Import — gramps-webapi >= 1.6.0, <= 3.11.0 → 3.11.1
- 2026-04-10 [CVE-2026-5059](https://erroneo.us/security/cve/CVE-2026-5059/index.md) aws-mcp has a Command Injection Remote Code Execution Vulnerability — aws-mcp <= 1.7.0 → no fix
- 2026-04-10 [CVE-2026-40157](https://erroneo.us/security/cve/CVE-2026-40157/index.md) PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack` — PraisonAI >= 2.7.2, < 4.5.128 → 4.5.128
- 2026-04-10 [CVE-2026-40289](https://erroneo.us/security/cve/CVE-2026-40289/index.md) PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions — praisonaiagents <= 1.5.139 → 1.5.140; PraisonAI <= 4.5.138 → 4.5.139
- 2026-04-10 [CVE-2026-1115](https://erroneo.us/security/cve/CVE-2026-1115/index.md) parisneo/lollms vulnerable to stored XSS in the social feature — lollms < 2.2.0 → 2.2.0
- 2026-04-10 [CVE-2026-40177](https://erroneo.us/security/cve/CVE-2026-40177/index.md) ajenti.plugin.core has password bypass when 2FA is activated — ajenti.plugin.core < 0.112 → 0.112
- 2026-04-09 [CVE-2025-57735](https://erroneo.us/security/cve/CVE-2025-57735/index.md) Apache Airflow: JWT token still valid after logout — apache-airflow >= 3.0.0, < 3.2.0 → 3.2.0
- 2026-04-08 [CVE-2026-39888](https://erroneo.us/security/cve/CVE-2026-39888/index.md) PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode) — praisonaiagents <= 1.5.114 → 1.5.115
- 2026-04-08 [CVE-2026-39890](https://erroneo.us/security/cve/CVE-2026-39890/index.md) PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading — praisonai <= 4.5.114 → 4.5.115
- 2026-04-08 [CVE-2026-40088](https://erroneo.us/security/cve/CVE-2026-40088/index.md) PraisonAI Vulnerable to OS Command Injection — PraisonAI < 4.5.121 → 4.5.121
- 2026-04-08 [CVE-2026-39987](https://erroneo.us/security/cve/CVE-2026-39987/index.md) Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass — marimo < 0.23.0 → 0.23.0
- 2026-04-07 [CVE-2026-1114](https://erroneo.us/security/cve/CVE-2026-1114/index.md) LoLLMs is vulnerable to Improper Access Control through weak secret key — lollms < 2.2.0 → 2.2.0
- 2026-04-06 [CVE-2026-35490](https://erroneo.us/security/cve/CVE-2026-35490/index.md) changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering — changedetection.io <= 0.54.7 → 0.54.8
- 2026-04-06 [CVE-2026-39305](https://erroneo.us/security/cve/CVE-2026-39305/index.md) PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator — PraisonAI <= 4.5.112 → 4.5.113
- 2026-04-06 [CVE-2026-35615](https://erroneo.us/security/cve/CVE-2026-35615/index.md) PraisonAI Has Path Traversal in FileTools — PraisonAI <= 1.5.112 → 1.5.113
- 2026-04-03 [CVE-2026-35030](https://erroneo.us/security/cve/CVE-2026-35030/index.md) LiteLLM: Authentication bypass via OIDC userinfo cache key collision — litellm < 1.83.0 → 1.83.0
- 2026-04-03 [CVE-2026-0545](https://erroneo.us/security/cve/CVE-2026-0545/index.md) mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization — mlflow <= 3.10.1 → no fix
- 2026-04-03 [CVE-2026-35459](https://erroneo.us/security/cve/CVE-2026-35459/index.md) pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992) — pyload-ng <= 0.5.0b3.dev96 → no fix
- 2026-04-02 [CVE-2026-5463](https://erroneo.us/security/cve/CVE-2026-5463/index.md) pymetasploit3 vulnerable to command injection in console.run_module_with_output() — pymetasploit3 <= 1.0.6 → no fix
- 2026-04-02 [CVE-2026-35171](https://erroneo.us/security/cve/CVE-2026-35171/index.md) Kedro has Arbitrary Code Execution via Malicious Logging Configuration — kedro < 1.3.0 → 1.3.0
- 2026-04-02 [CVE-2026-35002](https://erroneo.us/security/cve/CVE-2026-35002/index.md) Agno is vulnerable to Eval Injection — agno < 2.3.24 → 2.3.24

Pages: https://erroneo.us/security/ecosystem/pypi/index.md · https://erroneo.us/security/ecosystem/pypi/2/index.md · https://erroneo.us/security/ecosystem/pypi/3/index.md · https://erroneo.us/security/ecosystem/pypi/4/index.md · https://erroneo.us/security/ecosystem/pypi/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/pypi/2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt