Security Digest · page 3 of 5
Critical PyPI advisories (page 3)
451 critical advisories for PyPI packages since October 2023, newest first. Check your project with pip-audit (or: pip show <package>).
- PraisonAI Has Missing Authentication in WebSocket Gateway CVE-2026-34952 CVSS 9.1 Critical
praisonai<= 4.5.96 → fixed in 4.5.97 - PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() CVE-2026-34935 CVSS 9.8 Critical
praisonai>= 4.5.15, <= 4.5.68 → fixed in 4.5.69 - PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` CVE-2026-34934 CVSS 9.8 Critical
praisonai<= 4.5.89 → fixed in 4.5.90 - PraisonAI Has Authentication Bypass via OAuthManager.validate_token() CVE-2026-34953 CVSS 9.1 Critical
praisonai<= 4.5.96 → fixed in 4.5.97 - PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code CVE-2026-34938 CVSS 10.0 Critical
praisonaiagents<= 1.5.89 → fixed in 1.5.90 - FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability CVE-2026-32871 CVSS 10.0 Critical
fastmcp< 3.2.0 → fixed in 3.2.0 - Mlflow: Command Injection when serving models with enable_mlserver=True CVE-2026-0596 CVSS 9.6 Critical
mlflow< 3.9.0 → fixed in 3.9.0 - SciTokens is vulnerable to SQL Injection in KeyCache CVE-2026-32714 CVSS 9.8 Critical
scitokens< 1.9.6 → fixed in 1.9.6 - openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart GHSA-h45m-mgcp-q388 CVSS 9.1 Critical
openssl-encrypt< 1.4.0 → fixed in 1.4.0 - MLflow Command Injection vulnerability CVE-2025-15379 CVSS 10.0 Critical
mlflow< 3.8.1 → fixed in 3.8.1 - Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2 GHSA-955r-262c-33jc
telnyx>= 4.87.1, <= 4.87.2 → no fix listed - MLFlow path traversal vulnerability CVE-2025-15036 CVSS 9.6 Critical
mlflow< 3.9.0rc0 → fixed in 3.9.0rc0 - pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVE-2026-33992 CVSS 9.3 Critical
pyload-ng<= 0.5.0b3.dev96 → no fix listed - Langflow has Authenticated Code Execution in Agentic Assistant Validation CVE-2026-33873 CVSS 9.3 Critical
langflow<= 1.8.1 → fixed in 1.9.0 - Two LiteLLM versions published containing credential harvesting malware GHSA-5mg7-485q-xm76
litellm>= 1.82.7, <= 1.82.8 → no fix listed - Langflow has an Arbitrary File Write (RCE) via v2 API CVE-2026-33309 CVSS 9.9 Critical
langflow>= 1.2.0, < 1.9.0 → fixed in 1.9.0 - Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py CVE-2026-33057 CVSS 9.8 Critical
mesop<= 1.2.2 → fixed in 1.2.3 - Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion CVE-2026-33054 CVSS 10.0 Critical
mesop<= 1.2.2 → fixed in 1.2.3 - Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint CVE-2026-33017 CVSS 9.3 Critical
langflow<= 1.8.2 → fixed in 1.9.0 - Authlib JWS JWK Header Injection: Signature Verification Bypass CVE-2026-27962 CVSS 9.1 Critical
authlib<= 1.6.8 → fixed in 1.6.9 - Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVE-2026-32633 CVSS 9.1 Critical
Glances<= 4.5.2-dev01 → fixed in 4.5.2 - SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker CVE-2026-3059 CVSS 9.8 Critical
sglang<= 0.5.9 → fixed in 0.5.10 - SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module CVE-2026-3060 CVSS 9.8 Critical
sglang<= 0.5.9 → fixed in 0.5.10 - MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in… CVE-2026-27825 CVSS 9.0 Critical
mcp-atlassian< 0.17.0 → fixed in 0.17.0 - PickleScan's pkgutil.resolve_name has a universal blocklist bypass CVE-2026-3490 CVSS 10.0 Critical
picklescan< 1.0.4 → fixed in 1.0.4 - PickleScan has multiple stdlib modules with direct RCE not in blocklist CVE-2026-56315 CVSS 9.8 Critical
picklescan< 1.0.4 → fixed in 1.0.4 - PickleScan's profile.run blocklist mismatch allows exec() bypass CVE-2026-53873 CVSS 9.8 Critical
picklescan< 1.0.4 → fixed in 1.0.4 - Langflow has Remote Code Execution in CSV Agent CVE-2026-27966 CVSS 9.8 Critical
langflow<= 1.8.0rc2 → no fix listed - OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection CVE-2026-28370 CVSS 9.1 Critical
vitrage>= 15.0.0.0rc1, < 15.0.1 → fixed in 15.0.1;vitrage>= 14.0.0.0rc1, < 14.0.1 → fixed in 14.0.1;vitrage>= 13.0.0.0rc1, < 13.0.1 → fixed in 13.0.1; +1 more packages - Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering CVE-2026-27614 CVSS 9.3 Critical
bugsink<= 2.0.12 → fixed in 2.0.13 - Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection CVE-2026-27641 CVSS 9.8 Critical
flask-reuploaded< 1.5.0 → fixed in 1.5.0 - ormar is vulnerable to SQL Injection through aggregate functions min() and max() CVE-2026-26198 CVSS 9.8 Critical
ormar>= 0.9.9, <= 0.22.0 → fixed in 0.23.0 - MLflow Use of Default Password Authentication Bypass Vulnerability CVE-2026-2635 CVSS 9.8 Critical
mlflow< 3.8.0rc0 → fixed in 3.8.0rc0 - Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution CVE-2026-26030 CVSS 9.9 Critical
semantic-kernel< 1.39.4 → fixed in 1.39.4 - NLTK has a Zip Slip Vulnerability CVE-2025-14009 CVSS 10.0 Critical
nltk<= 3.9.2 → fixed in 3.9.3 - Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE CVE-2026-21531 CVSS 9.8 Critical
azure-ai-language-conversations-authoring< 1.0.0b4 → fixed in 1.0.0b4 - Keylime Missing Authentication for Critical Function and Improper Authentication CVE-2026-1709 CVSS 9.4 Critical
keylime>= 7.12.0, < 7.12.2 → fixed in 7.12.2;keylime= 7.13.0 → fixed in 7.13.1 - A single post-release of dydx-v4-client contained obfuscated multi-stage loader GHSA-4f84-67cv-qrv3 CVSS 9.3 Critical
dydx-v4-client= 1.1.5.post1 → fixed in 1.1.5 - Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25592 CVSS 9.9 Critical
semantic-kernel< 1.39.3 → fixed in 1.39.3;Microsoft.SemanticKernel.Core< 1.71.0 → fixed in 1.71.0 - EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) CVE-2026-25632 CVSS 10.0 Critical
epyt-flow< 0.16.1 → fixed in 0.16.1 - Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write CVE-2025-64712 CVSS 9.8 Critical
unstructured<= 0.18.17 → fixed in 0.18.18 - Langroid has WAF Bypass Leading to RCE in TableChatAgent CVE-2026-25481 CVSS 9.4 Critical
langroid<= 0.59.31 → fixed in 0.59.32 - H2O has an External Control of File Name or Path vulnerability CVE-2024-5986 CVSS 9.1 Critical
ai.h2o:h2o-core<= 3.46.0.1 → no fix listed;h2o<= 3.46.0.1 → no fix listed - Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication CVE-2026-25505 CVSS 9.8 Critical
bambuddy< 0.1.7 → fixed in 0.1.7 - vLLM has RCE In Video Processing CVE-2026-22778 CVSS 9.8 Critical
vllm>= 0.8.3, < 0.14.1 → fixed in 0.14.1 - CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection CVE-2026-25130 CVSS 9.6 Critical
cai-framework<= 0.5.10 → no fix listed - Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure) GHSA-vg9h-jx4v-cwx2 CVSS 9.3 Critical
dfir-unfurl<= 20250810 → no fix listed - dcap-qvl has Missing Verification for QE Identity CVE-2026-22696 CVSS 9.3 Critical
dcap-qvl< 0.3.9 → fixed in 0.3.9;@phala/dcap-qvl<= 0.3.0 → fixed in 0.3.9;@phala/dcap-qvl-web<= 0.3.3 → no fix listed; +2 more packages - Crawl4AI Has Local File Inclusion in Docker API via file:// URLs CVE-2026-26217 CVSS 9.2 Critical
crawl4ai< 0.8.0 → fixed in 0.8.0 - Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter CVE-2026-26216 CVSS 10.0 Critical
Crawl4AI< 0.8.0 → fixed in 0.8.0 - Salesforce Uni2TS has a Code Injection vulnerability CVE-2026-22584 CVSS 9.8 Critical
uni2ts<= 1.2.0 → fixed in 2.0.0 - wolfSSL Python module vulnerable to Improper Authentication CVE-2025-15346 CVSS 9.3 Critical
wolfssl< 5.8.4.post0 → fixed in 5.8.4.post0 - terminal-controller-mcp vulnerable to Command Injection CVE-2025-61492 CVSS 10.0 Critical
terminal-controller<= 0.1.7 → no fix listed - Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE CVE-2025-14931 CVSS 10.0 Critical
smolagents<= 1.23.0 → no fix listed - LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs CVE-2025-68664 CVSS 9.3 Critical
langchain-core>= 1.0.0, < 1.2.5 → fixed in 1.2.5;langchain-core< 0.3.81 → fixed in 0.3.81 - Weblate is vulnerable to RCE through Git config file overwrite CVE-2025-68398 CVSS 9.1 Critical
Weblate< 5.15.1 → fixed in 5.15.1 - Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context CVE-2025-67895 CVSS 9.8 Critical
apache-airflow-providers-edge3< 2.0.0 → fixed in 2.0.0 - pgadmin4 has a Meta-Command Filter Command Execution CVE-2025-13780 CVSS 9.1 Critical
pgadmin4< 9.11 → fixed in 9.11 - Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool CVE-2025-67511 CVSS 9.6 Critical
cai-framework<= 0.5.9 → no fix listed - Langflow CORS misconfiguration enables Account Takeover and RCE CVE-2025-34291 CVSS 9.4 Critical
langflow<= 1.6.9 → fixed in 1.7.0 - asyncmy is vulnerable to SQL injection via crafted dict keys CVE-2025-65896 CVSS 9.8 Critical
asyncmy<= 0.2.11 → no fix listed - Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593 CVSS 9.4 Critical
ray< 2.52.0 → fixed in 2.52.0 - Ray's New Token Authentication is Disabled By Default CVE-2025-34351 CVSS 9.3 Critical
ray<= 2.52.0 → no fix listed - joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads CVE-2025-65015 CVSS 9.2 Critical
joserfc>= 1.3.3, < 1.3.5 → fixed in 1.3.5;joserfc>= 1.4.0, < 1.4.2 → fixed in 1.4.2 - Modular Max Serve has Unsafe Deserialization vulnerability CVE-2025-60455 CVSS 9.3 Critical
modular< 25.6.0 → fixed in 25.6.0 - AstrBot is vulnerable to RCE with hard-coded JWT signing keys CVE-2025-55449 CVSS 9.8 Critical
astrbot< 3.5.18 → fixed in 3.5.18 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode CVE-2025-12762 CVSS 9.1 Critical
pgadmin4< 9.10 → fixed in 9.10 - Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. CVE-2025-64459 CVSS 9.1 Critical
django>= 5.2a1, < 5.2.8 → fixed in 5.2.8;django>= 5.0a1, < 5.1.14 → fixed in 5.1.14;django< 4.2.26 → fixed in 4.2.26 - pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer CVE-2025-62515 CVSS 9.8 Critical
pyquokka<= 0.3.1 → no fix listed - Keras framework vulnerable to deserialization of untrusted data CVE-2025-49655 CVSS 9.8 Critical
keras>= 3.11.0, < 3.11.3 → fixed in 3.11.3 - scio is vunerable to Remote Command Execution through PyTorch GHSA-m9mp-6x32-5rhg CVSS 9.3 Critical
scio-pypi<= 1.0.0 → no fix listed - BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE CVE-2025-10283 CVSS 9.6 Critical
bbot< 2.7.0 → fixed in 2.7.0 - BBOT's various issues in unarchive.py can cause arbitrary file write and RCE CVE-2025-10284 CVSS 9.6 Critical
bbot< 2.7.0 → fixed in 2.7.0 - Apache Pyfory python is vulnerable to deserialization of untrusted data CVE-2025-61622 CVSS 9.8 Critical
pyfory>= 0.12.0, < 0.12.3 → fixed in 0.12.3;pyfury>= 0.1.0, <= 0.10.3 → no fix listed - Apache IoTDB: Deserialization of untrusted Data CVE-2025-48459 CVSS 9.3 Critical
org.apache.iotdb:iotdb-confignode>= 1.0.0, < 2.0.5 → fixed in 2.0.5;apache-iotdb>= 1.0.0, < 2.0.5 → fixed in 2.0.5 - H2O affected by a deserialization vulnerability CVE-2025-6544 CVSS 9.8 Critical
ai.h2o:h2o-core<= 3.46.0.7 → no fix listed;h2o<= 3.46.0.7 → no fix listed - InvokeAI has External Control of File Name or Path CVE-2025-6237 CVSS 9.3 Critical
invokeai< 6.7.0 → fixed in 6.7.0 - mcp-kubernetes-server has an OS Command Injection vulnerability CVE-2025-59377 CVSS 9.8 Critical
mcp-kubernetes-server<= 0.1.11 → no fix listed - Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check CVE-2025-10156 CVSS 9.3 Critical
picklescan<= 0.0.30 → fixed in 0.0.31 - Picklescan Bypass is Possible via File Extension Mismatch CVE-2025-10155 CVSS 9.3 Critical
picklescan<= 0.0.30 → fixed in 0.0.31 - Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports CVE-2025-10157 CVSS 9.3 Critical
picklescan<= 0.0.30 → fixed in 0.0.31 - internetarchive Vulnerable to Directory Traversal in File.download() CVE-2025-58438 CVSS 9.4 Critical
internetarchive<= 5.5.0 → fixed in 5.5.1 - TkEasyGUI Vulnerable to OS Command Injection CVE-2025-55037 CVSS 9.3 Critical
TkEasyGUI< 1.0.22 → fixed in 1.0.22 - Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution GHSA-58p5-r2f6-g2cj CVSS 9.4 Critical
usd-core< 25.8 → fixed in 25.8 - DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more CVE-2025-58367 CVSS 10.0 Critical
deepdiff>= 5.0.0, <= 8.6.0 → fixed in 8.6.1 - ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE) CVE-2025-54802 CVSS 9.8 Critical
pyload-ng<= 0.5.0b3.dev89 → fixed in 0.5.0b3.dev90 - BentoML SSRF Vulnerability in File Upload Processing CVE-2025-54381 CVSS 9.9 Critical
bentoml>= 1.4.0, < 1.4.19 → fixed in 1.4.19 - smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module CVE-2025-5120 CVSS 9.9 Critical
smolagents< 1.17.0 → fixed in 1.17.0 - pyLoad vulnerable to XSS through insecure CAPTCHA CVE-2025-53890 CVSS 9.8 Critical
pyload-ng< 0.20 → fixed in 0.20 - Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator CVE-2025-50213 CVSS 9.8 Critical
apache-airflow-providers-snowflake< 6.4.0 → fixed in 6.4.0 - rfc3161-client has insufficient verification for timestamp response signatures CVE-2025-52556 CVSS 9.3 Critical
rfc3161-client<= 1.0.2 → fixed in 1.0.3 - Langflow Unauth RCE CVE-2025-3248 CVSS 9.3 Critical
langflow< 1.3.0 → fixed in 1.3.0;langflow-base< 0.3.0 → fixed in 0.3.0 - Salt vulnerable to directory traversal attack in file receiving method CVE-2024-38824 CVSS 9.6 Critical
salt>= 3007.0rc1, < 3007.4 → fixed in 3007.4;salt>= 3006.0rc1, < 3006.12 → fixed in 3006.12 - BackendAI Missing Authentication for Critical Function CVE-2025-49652 CVSS 9.8 Critical
backend.ai< 25.15.6 → fixed in 25.15.6;backend.ai>= 25.16.0rc1, < 25.19.0rc1 → fixed in 25.19.0rc1 - llama_index vulnerable to SQL Injection CVE-2025-1793 CVSS 9.8 Critical
llama-index< 0.12.28 → fixed in 0.12.28