---
title: "Critical PyPI advisories (page 3)"
url: https://erroneo.us/security/ecosystem/pypi/3/
description: "All 451 critical GitHub-reviewed PyPI security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 3 of 5."
type: ecosystem
section: "Security Digest"
date_modified: 2026-04-01
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical PyPI advisories (page 3)

- 2026-04-01 [CVE-2026-34952](https://erroneo.us/security/cve/CVE-2026-34952/index.md) PraisonAI Has Missing Authentication in WebSocket Gateway — praisonai <= 4.5.96 → 4.5.97
- 2026-04-01 [CVE-2026-34935](https://erroneo.us/security/cve/CVE-2026-34935/index.md) PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() — praisonai >= 4.5.15, <= 4.5.68 → 4.5.69
- 2026-04-01 [CVE-2026-34934](https://erroneo.us/security/cve/CVE-2026-34934/index.md) PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` — praisonai <= 4.5.89 → 4.5.90
- 2026-04-01 [CVE-2026-34953](https://erroneo.us/security/cve/CVE-2026-34953/index.md) PraisonAI Has Authentication Bypass via OAuthManager.validate_token() — praisonai <= 4.5.96 → 4.5.97
- 2026-04-01 [CVE-2026-34938](https://erroneo.us/security/cve/CVE-2026-34938/index.md) PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code — praisonaiagents <= 1.5.89 → 1.5.90
- 2026-03-31 [CVE-2026-32871](https://erroneo.us/security/cve/CVE-2026-32871/index.md) FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability — fastmcp < 3.2.0 → 3.2.0
- 2026-03-31 [CVE-2026-0596](https://erroneo.us/security/cve/CVE-2026-0596/index.md) Mlflow: Command Injection when serving models with enable_mlserver=True — mlflow < 3.9.0 → 3.9.0
- 2026-03-31 [CVE-2026-32714](https://erroneo.us/security/cve/CVE-2026-32714/index.md) SciTokens is vulnerable to SQL Injection in KeyCache — scitokens < 1.9.6 → 1.9.6
- 2026-03-31 [GHSA-h45m-mgcp-q388](https://erroneo.us/security/ghsa/GHSA-h45m-mgcp-q388/index.md) openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart — openssl-encrypt < 1.4.0 → 1.4.0
- 2026-03-30 [CVE-2025-15379](https://erroneo.us/security/cve/CVE-2025-15379/index.md) MLflow Command Injection vulnerability — mlflow < 3.8.1 → 3.8.1
- 2026-03-30 [GHSA-955r-262c-33jc](https://erroneo.us/security/ghsa/GHSA-955r-262c-33jc/index.md) Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2 — telnyx >= 4.87.1, <= 4.87.2 → no fix
- 2026-03-29 [CVE-2025-15036](https://erroneo.us/security/cve/CVE-2025-15036/index.md) MLFlow path traversal vulnerability — mlflow < 3.9.0rc0 → 3.9.0rc0
- 2026-03-27 [CVE-2026-33992](https://erroneo.us/security/cve/CVE-2026-33992/index.md) pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration — pyload-ng <= 0.5.0b3.dev96 → no fix
- 2026-03-26 [CVE-2026-33873](https://erroneo.us/security/cve/CVE-2026-33873/index.md) Langflow has Authenticated Code Execution in Agentic Assistant Validation — langflow <= 1.8.1 → 1.9.0
- 2026-03-25 [GHSA-5mg7-485q-xm76](https://erroneo.us/security/ghsa/GHSA-5mg7-485q-xm76/index.md) Two LiteLLM versions published containing credential harvesting malware — litellm >= 1.82.7, <= 1.82.8 → no fix
- 2026-03-19 [CVE-2026-33309](https://erroneo.us/security/cve/CVE-2026-33309/index.md) Langflow has an Arbitrary File Write (RCE) via v2 API — langflow >= 1.2.0, < 1.9.0 → 1.9.0
- 2026-03-18 [CVE-2026-33057](https://erroneo.us/security/cve/CVE-2026-33057/index.md) Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py — mesop <= 1.2.2 → 1.2.3
- 2026-03-18 [CVE-2026-33054](https://erroneo.us/security/cve/CVE-2026-33054/index.md) Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion — mesop <= 1.2.2 → 1.2.3
- 2026-03-17 [CVE-2026-33017](https://erroneo.us/security/cve/CVE-2026-33017/index.md) Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint — langflow <= 1.8.2 → 1.9.0
- 2026-03-16 [CVE-2026-27962](https://erroneo.us/security/cve/CVE-2026-27962/index.md) Authlib JWS JWK Header Injection: Signature Verification Bypass — authlib <= 1.6.8 → 1.6.9
- 2026-03-16 [CVE-2026-32633](https://erroneo.us/security/cve/CVE-2026-32633/index.md) Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` — Glances <= 4.5.2-dev01 → 4.5.2
- 2026-03-12 [CVE-2026-3059](https://erroneo.us/security/cve/CVE-2026-3059/index.md) SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker — sglang <= 0.5.9 → 0.5.10
- 2026-03-12 [CVE-2026-3060](https://erroneo.us/security/cve/CVE-2026-3060/index.md) SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module — sglang <= 0.5.9 → 0.5.10
- 2026-03-10 [CVE-2026-27825](https://erroneo.us/security/cve/CVE-2026-27825/index.md) MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment — mcp-atlassian < 0.17.0 → 0.17.0
- 2026-03-03 [CVE-2026-3490](https://erroneo.us/security/cve/CVE-2026-3490/index.md) PickleScan's pkgutil.resolve_name has a universal blocklist bypass — picklescan < 1.0.4 → 1.0.4
- 2026-03-03 [CVE-2026-56315](https://erroneo.us/security/cve/CVE-2026-56315/index.md) PickleScan has multiple stdlib modules with direct RCE not in blocklist — picklescan < 1.0.4 → 1.0.4
- 2026-03-03 [CVE-2026-53873](https://erroneo.us/security/cve/CVE-2026-53873/index.md) PickleScan's profile.run blocklist mismatch allows exec() bypass — picklescan < 1.0.4 → 1.0.4
- 2026-02-27 [CVE-2026-27966](https://erroneo.us/security/cve/CVE-2026-27966/index.md) Langflow has Remote Code Execution in CSV Agent — langflow <= 1.8.0rc2 → no fix
- 2026-02-26 [CVE-2026-28370](https://erroneo.us/security/cve/CVE-2026-28370/index.md) OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection — vitrage >= 15.0.0.0rc1, < 15.0.1 → 15.0.1; vitrage >= 14.0.0.0rc1, < 14.0.1 → 14.0.1; vitrage >= 13.0.0.0rc1, < 13.0.1 → 13.0.1
- 2026-02-25 [CVE-2026-27614](https://erroneo.us/security/cve/CVE-2026-27614/index.md) Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering — bugsink <= 2.0.12 → 2.0.13
- 2026-02-25 [CVE-2026-27641](https://erroneo.us/security/cve/CVE-2026-27641/index.md) Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection — flask-reuploaded < 1.5.0 → 1.5.0
- 2026-02-23 [CVE-2026-26198](https://erroneo.us/security/cve/CVE-2026-26198/index.md) ormar is vulnerable to SQL Injection through aggregate functions min() and max() — ormar >= 0.9.9, <= 0.22.0 → 0.23.0
- 2026-02-20 [CVE-2026-2635](https://erroneo.us/security/cve/CVE-2026-2635/index.md) MLflow Use of Default Password Authentication Bypass Vulnerability — mlflow < 3.8.0rc0 → 3.8.0rc0
- 2026-02-19 [CVE-2026-26030](https://erroneo.us/security/cve/CVE-2026-26030/index.md) Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution — semantic-kernel < 1.39.4 → 1.39.4
- 2026-02-18 [CVE-2025-14009](https://erroneo.us/security/cve/CVE-2025-14009/index.md) NLTK has a Zip Slip Vulnerability — nltk <= 3.9.2 → 3.9.3
- 2026-02-10 [CVE-2026-21531](https://erroneo.us/security/cve/CVE-2026-21531/index.md) Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE — azure-ai-language-conversations-authoring < 1.0.0b4 → 1.0.0b4
- 2026-02-06 [CVE-2026-1709](https://erroneo.us/security/cve/CVE-2026-1709/index.md) Keylime Missing Authentication for Critical Function and Improper Authentication — keylime >= 7.12.0, < 7.12.2 → 7.12.2; keylime = 7.13.0 → 7.13.1
- 2026-02-06 [GHSA-4f84-67cv-qrv3](https://erroneo.us/security/ghsa/GHSA-4f84-67cv-qrv3/index.md) A single post-release of dydx-v4-client contained obfuscated multi-stage loader — dydx-v4-client = 1.1.5.post1 → 1.1.5
- 2026-02-06 [CVE-2026-25592](https://erroneo.us/security/cve/CVE-2026-25592/index.md) Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK — semantic-kernel < 1.39.3 → 1.39.3; Microsoft.SemanticKernel.Core < 1.71.0 → 1.71.0
- 2026-02-04 [CVE-2026-25632](https://erroneo.us/security/cve/CVE-2026-25632/index.md) EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) — epyt-flow < 0.16.1 → 0.16.1
- 2026-02-03 [CVE-2025-64712](https://erroneo.us/security/cve/CVE-2025-64712/index.md) Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write — unstructured <= 0.18.17 → 0.18.18
- 2026-02-02 [CVE-2026-25481](https://erroneo.us/security/cve/CVE-2026-25481/index.md) Langroid has WAF Bypass Leading to RCE in TableChatAgent — langroid <= 0.59.31 → 0.59.32
- 2026-02-02 [CVE-2024-5986](https://erroneo.us/security/cve/CVE-2024-5986/index.md) H2O has an External Control of File Name or Path vulnerability — ai.h2o:h2o-core <= 3.46.0.1 → no fix; h2o <= 3.46.0.1 → no fix
- 2026-02-02 [CVE-2026-25505](https://erroneo.us/security/cve/CVE-2026-25505/index.md) Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication — bambuddy < 0.1.7 → 0.1.7
- 2026-02-02 [CVE-2026-22778](https://erroneo.us/security/cve/CVE-2026-22778/index.md) vLLM has RCE In Video Processing — vllm >= 0.8.3, < 0.14.1 → 0.14.1
- 2026-01-30 [CVE-2026-25130](https://erroneo.us/security/cve/CVE-2026-25130/index.md) CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection — cai-framework <= 0.5.10 → no fix
- 2026-01-29 [GHSA-vg9h-jx4v-cwx2](https://erroneo.us/security/ghsa/GHSA-vg9h-jx4v-cwx2/index.md) Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure) — dfir-unfurl <= 20250810 → no fix
- 2026-01-26 [CVE-2026-22696](https://erroneo.us/security/cve/CVE-2026-22696/index.md) dcap-qvl has Missing Verification for QE Identity — dcap-qvl < 0.3.9 → 0.3.9; @phala/dcap-qvl <= 0.3.0 → 0.3.9; @phala/dcap-qvl-web <= 0.3.3 → no fix
- 2026-01-16 [CVE-2026-26217](https://erroneo.us/security/cve/CVE-2026-26217/index.md) Crawl4AI Has Local File Inclusion in Docker API via file:// URLs — crawl4ai < 0.8.0 → 0.8.0
- 2026-01-16 [CVE-2026-26216](https://erroneo.us/security/cve/CVE-2026-26216/index.md) Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter — Crawl4AI < 0.8.0 → 0.8.0
- 2026-01-09 [CVE-2026-22584](https://erroneo.us/security/cve/CVE-2026-22584/index.md) Salesforce Uni2TS has a Code Injection vulnerability — uni2ts <= 1.2.0 → 2.0.0
- 2026-01-07 [CVE-2025-15346](https://erroneo.us/security/cve/CVE-2025-15346/index.md) wolfSSL Python module vulnerable to Improper Authentication — wolfssl < 5.8.4.post0 → 5.8.4.post0
- 2026-01-07 [CVE-2025-61492](https://erroneo.us/security/cve/CVE-2025-61492/index.md) terminal-controller-mcp vulnerable to Command Injection — terminal-controller <= 0.1.7 → no fix
- 2025-12-23 [CVE-2025-14931](https://erroneo.us/security/cve/CVE-2025-14931/index.md) Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE — smolagents <= 1.23.0 → no fix
- 2025-12-23 [CVE-2025-68664](https://erroneo.us/security/cve/CVE-2025-68664/index.md) LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs — langchain-core >= 1.0.0, < 1.2.5 → 1.2.5; langchain-core < 0.3.81 → 0.3.81
- 2025-12-18 [CVE-2025-68398](https://erroneo.us/security/cve/CVE-2025-68398/index.md) Weblate is vulnerable to RCE through Git config file overwrite — Weblate < 5.15.1 → 5.15.1
- 2025-12-17 [CVE-2025-67895](https://erroneo.us/security/cve/CVE-2025-67895/index.md) Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context — apache-airflow-providers-edge3 < 2.0.0 → 2.0.0
- 2025-12-11 [CVE-2025-13780](https://erroneo.us/security/cve/CVE-2025-13780/index.md) pgadmin4 has a Meta-Command Filter Command Execution — pgadmin4 < 9.11 → 9.11
- 2025-12-09 [CVE-2025-67511](https://erroneo.us/security/cve/CVE-2025-67511/index.md) Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool — cai-framework <= 0.5.9 → no fix
- 2025-12-05 [CVE-2025-34291](https://erroneo.us/security/cve/CVE-2025-34291/index.md) Langflow CORS misconfiguration enables Account Takeover and RCE — langflow <= 1.6.9 → 1.7.0
- 2025-12-02 [CVE-2025-65896](https://erroneo.us/security/cve/CVE-2025-65896/index.md) asyncmy is vulnerable to SQL injection via crafted dict keys — asyncmy <= 0.2.11 → no fix
- 2025-11-26 [CVE-2025-62593](https://erroneo.us/security/cve/CVE-2025-62593/index.md) Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack — ray < 2.52.0 → 2.52.0
- 2025-11-26 [CVE-2025-34351](https://erroneo.us/security/cve/CVE-2025-34351/index.md) Ray's New Token Authentication is Disabled By Default — ray <= 2.52.0 → no fix
- 2025-11-18 [CVE-2025-65015](https://erroneo.us/security/cve/CVE-2025-65015/index.md) joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads — joserfc >= 1.3.3, < 1.3.5 → 1.3.5; joserfc >= 1.4.0, < 1.4.2 → 1.4.2
- 2025-11-18 [CVE-2025-60455](https://erroneo.us/security/cve/CVE-2025-60455/index.md) Modular Max Serve has Unsafe Deserialization vulnerability — modular < 25.6.0 → 25.6.0
- 2025-11-14 [CVE-2025-55449](https://erroneo.us/security/cve/CVE-2025-55449/index.md) AstrBot is vulnerable to RCE with hard-coded JWT signing keys — astrbot < 3.5.18 → 3.5.18
- 2025-11-13 [CVE-2025-12762](https://erroneo.us/security/cve/CVE-2025-12762/index.md) pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode — pgadmin4 < 9.10 → 9.10
- 2025-11-05 [CVE-2025-64459](https://erroneo.us/security/cve/CVE-2025-64459/index.md) Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. — django >= 5.2a1, < 5.2.8 → 5.2.8; django >= 5.0a1, < 5.1.14 → 5.1.14; django < 4.2.26 → 4.2.26
- 2025-10-17 [CVE-2025-62515](https://erroneo.us/security/cve/CVE-2025-62515/index.md) pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer — pyquokka <= 0.3.1 → no fix
- 2025-10-17 [CVE-2025-49655](https://erroneo.us/security/cve/CVE-2025-49655/index.md) Keras framework vulnerable to deserialization of untrusted data — keras >= 3.11.0, < 3.11.3 → 3.11.3
- 2025-10-09 [GHSA-m9mp-6x32-5rhg](https://erroneo.us/security/ghsa/GHSA-m9mp-6x32-5rhg/index.md) scio is vunerable to  Remote Command Execution  through PyTorch — scio-pypi <= 1.0.0 → no fix
- 2025-10-09 [CVE-2025-10283](https://erroneo.us/security/cve/CVE-2025-10283/index.md) BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE — bbot < 2.7.0 → 2.7.0
- 2025-10-09 [CVE-2025-10284](https://erroneo.us/security/cve/CVE-2025-10284/index.md) BBOT's various issues in unarchive.py can cause arbitrary file write and RCE — bbot < 2.7.0 → 2.7.0
- 2025-10-01 [CVE-2025-61622](https://erroneo.us/security/cve/CVE-2025-61622/index.md) Apache Pyfory python is vulnerable to deserialization of untrusted data — pyfory >= 0.12.0, < 0.12.3 → 0.12.3; pyfury >= 0.1.0, <= 0.10.3 → no fix
- 2025-09-24 [CVE-2025-48459](https://erroneo.us/security/cve/CVE-2025-48459/index.md) Apache IoTDB: Deserialization of untrusted Data — org.apache.iotdb:iotdb-confignode >= 1.0.0, < 2.0.5 → 2.0.5; apache-iotdb >= 1.0.0, < 2.0.5 → 2.0.5
- 2025-09-22 [CVE-2025-6544](https://erroneo.us/security/cve/CVE-2025-6544/index.md) H2O affected by a deserialization vulnerability — ai.h2o:h2o-core <= 3.46.0.7 → no fix; h2o <= 3.46.0.7 → no fix
- 2025-09-18 [CVE-2025-6237](https://erroneo.us/security/cve/CVE-2025-6237/index.md) InvokeAI has External Control of File Name or Path — invokeai < 6.7.0 → 6.7.0
- 2025-09-15 [CVE-2025-59377](https://erroneo.us/security/cve/CVE-2025-59377/index.md) mcp-kubernetes-server has an OS Command Injection vulnerability — mcp-kubernetes-server <= 0.1.11 → no fix
- 2025-09-10 [CVE-2025-10156](https://erroneo.us/security/cve/CVE-2025-10156/index.md) Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check — picklescan <= 0.0.30 → 0.0.31
- 2025-09-10 [CVE-2025-10155](https://erroneo.us/security/cve/CVE-2025-10155/index.md) Picklescan Bypass is Possible via File Extension Mismatch — picklescan <= 0.0.30 → 0.0.31
- 2025-09-10 [CVE-2025-10157](https://erroneo.us/security/cve/CVE-2025-10157/index.md) Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports — picklescan <= 0.0.30 → 0.0.31
- 2025-09-05 [CVE-2025-58438](https://erroneo.us/security/cve/CVE-2025-58438/index.md) internetarchive Vulnerable to Directory Traversal in File.download() — internetarchive <= 5.5.0 → 5.5.1
- 2025-09-04 [CVE-2025-55037](https://erroneo.us/security/cve/CVE-2025-55037/index.md) TkEasyGUI Vulnerable to OS Command Injection — TkEasyGUI < 1.0.22 → 1.0.22
- 2025-09-04 [GHSA-58p5-r2f6-g2cj](https://erroneo.us/security/ghsa/GHSA-58p5-r2f6-g2cj/index.md) Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution — usd-core < 25.8 → 25.8
- 2025-09-03 [CVE-2025-58367](https://erroneo.us/security/cve/CVE-2025-58367/index.md) DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more — deepdiff >= 5.0.0, <= 8.6.0 → 8.6.1
- 2025-08-07 [CVE-2025-54951](https://erroneo.us/security/cve/CVE-2025-54951/index.md) ExecuTorch vulnerable to Heap-based Buffer Overflow — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-30404](https://erroneo.us/security/cve/CVE-2025-30404/index.md) ExecuTorch integer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-54950](https://erroneo.us/security/cve/CVE-2025-54950/index.md) ExecuTorch out-of-bounds access vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-54949](https://erroneo.us/security/cve/CVE-2025-54949/index.md) ExecuTorch heap buffer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-30405](https://erroneo.us/security/cve/CVE-2025-30405/index.md) ExecuTorch integer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-04 [CVE-2025-54802](https://erroneo.us/security/cve/CVE-2025-54802/index.md) pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE) — pyload-ng <= 0.5.0b3.dev89 → 0.5.0b3.dev90
- 2025-07-29 [CVE-2025-54381](https://erroneo.us/security/cve/CVE-2025-54381/index.md) BentoML SSRF Vulnerability in File Upload Processing — bentoml >= 1.4.0, < 1.4.19 → 1.4.19
- 2025-07-27 [CVE-2025-5120](https://erroneo.us/security/cve/CVE-2025-5120/index.md) smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module — smolagents < 1.17.0 → 1.17.0
- 2025-07-15 [CVE-2025-53890](https://erroneo.us/security/cve/CVE-2025-53890/index.md) pyLoad vulnerable to XSS through insecure CAPTCHA — pyload-ng < 0.20 → 0.20
- 2025-06-26 [CVE-2025-50213](https://erroneo.us/security/cve/CVE-2025-50213/index.md) Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator — apache-airflow-providers-snowflake < 6.4.0 → 6.4.0
- 2025-06-20 [CVE-2025-52556](https://erroneo.us/security/cve/CVE-2025-52556/index.md) rfc3161-client has insufficient verification for timestamp response signatures — rfc3161-client <= 1.0.2 → 1.0.3
- 2025-06-17 [CVE-2025-3248](https://erroneo.us/security/cve/CVE-2025-3248/index.md) Langflow Unauth RCE — langflow < 1.3.0 → 1.3.0; langflow-base < 0.3.0 → 0.3.0
- 2025-06-13 [CVE-2024-38824](https://erroneo.us/security/cve/CVE-2024-38824/index.md) Salt vulnerable to directory traversal attack in file receiving method — salt >= 3007.0rc1, < 3007.4 → 3007.4; salt >= 3006.0rc1, < 3006.12 → 3006.12
- 2025-06-09 [CVE-2025-49652](https://erroneo.us/security/cve/CVE-2025-49652/index.md) BackendAI Missing Authentication for Critical Function — backend.ai < 25.15.6 → 25.15.6; backend.ai >= 25.16.0rc1, < 25.19.0rc1 → 25.19.0rc1
- 2025-06-04 [CVE-2025-1793](https://erroneo.us/security/cve/CVE-2025-1793/index.md) llama_index vulnerable to SQL Injection — llama-index < 0.12.28 → 0.12.28

Pages: https://erroneo.us/security/ecosystem/pypi/index.md · https://erroneo.us/security/ecosystem/pypi/2/index.md · https://erroneo.us/security/ecosystem/pypi/3/index.md · https://erroneo.us/security/ecosystem/pypi/4/index.md · https://erroneo.us/security/ecosystem/pypi/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/pypi/3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt