---
title: "Critical PyPI advisories"
url: https://erroneo.us/security/ecosystem/pypi/
description: "All 451 critical GitHub-reviewed PyPI security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical PyPI advisories

- 2026-10-21 [CVE-2026-112900](https://erroneo.us/security/cve/CVE-2026-112900/index.md) Pillow: Argument Injection in Ghostscript call, potentially leading into RCE — Pillow >= 2.6.0, < 13.0.0 → 13.0.0
- 2026-10-21 [CVE-2026-112393](https://erroneo.us/security/cve/CVE-2026-112393/index.md) Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO — Pillow >= 2.0.0, < 13.0.0 → 13.0.0
- 2026-10-20 [GHSA-hq85-5cpj-mr62](https://erroneo.us/security/ghsa/GHSA-hq85-5cpj-mr62/index.md) uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised — uv < 0.13.4 → 0.13.4
- 2026-10-20 [CVE-2026-112403](https://erroneo.us/security/cve/CVE-2026-112403/index.md) Pillow: Heap buffer overflow in ImagingJpegDecode — Pillow <= 12.3.0 → 13.0.0
- 2026-10-20 [GHSA-6q48-6c7w-9gw2](https://erroneo.us/security/ghsa/GHSA-6q48-6c7w-9gw2/index.md) certifi bundles emSign root CAs with compromised intermediate CA keys — certifi >= 2019.03.09, < 2026.10.19 → 2026.10.19
- 2026-10-19 [CVE-2026-111058](https://erroneo.us/security/cve/CVE-2026-111058/index.md) Mercury: Unauthenticated Remote Code Execution via /api/kernels — mercury <= 3.2.5 → 3.2.6
- 2026-10-19 [CVE-2026-111057](https://erroneo.us/security/cve/CVE-2026-111057/index.md) Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass — mercury >= 3.0.0, <= 3.2.3 → 3.2.4
- 2026-10-16 [CVE-2026-105192](https://erroneo.us/security/cve/CVE-2026-105192/index.md) LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport — lmcache >= 0.3.9, < 0.5.6 → 0.5.6
- 2026-10-16 [CVE-2026-96620](https://erroneo.us/security/cve/CVE-2026-96620/index.md) Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution — claude-agent-sdk < 0.2.121 → 0.2.121
- 2026-10-08 [CVE-2026-61445](https://erroneo.us/security/cve/CVE-2026-61445/index.md) PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls — praisonai <= 4.6.77 → 4.6.78
- 2026-10-08 [CVE-2026-61447](https://erroneo.us/security/cve/CVE-2026-61447/index.md) PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets — praisonaiagents <= 1.6.77 → 1.6.78
- 2026-10-07 [CVE-2026-105697](https://erroneo.us/security/cve/CVE-2026-105697/index.md) Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration — langflow >= 1.1.2, < 1.10.3 → 1.10.3; langflow-base >= 0.1.2, < 0.10.3 → 0.10.3; lfx < 1.10.3 → 1.10.3
- 2026-10-07 [CVE-2026-62176](https://erroneo.us/security/cve/CVE-2026-62176/index.md) PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation — PraisonAI <= 4.6.77 → 4.6.78
- 2026-10-06 [CVE-2026-10561](https://erroneo.us/security/cve/CVE-2026-10561/index.md) Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation — langflow < 1.10.1 → 1.10.1
- 2026-10-05 [CVE-2026-9205](https://erroneo.us/security/cve/CVE-2026-9205/index.md) Langflow: Weak Fernet Key via random.seed() — langflow <= 1.10.0 → 1.10.1
- 2026-10-05 [CVE-2026-8505](https://erroneo.us/security/cve/CVE-2026-8505/index.md) Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass — langflow >= 1.7.0, <= 1.9.0 → 1.9.1
- 2026-10-02 [GHSA-v2f8-6655-7grj](https://erroneo.us/security/ghsa/GHSA-v2f8-6655-7grj/index.md) Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain — vibe-trading-ai >= 0.1.0, < 0.1.7 → 0.1.7
- 2026-10-02 [GHSA-jqmf-mx4f-hfr6](https://erroneo.us/security/ghsa/GHSA-jqmf-mx4f-hfr6/index.md) Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF — vibe-trading-ai >= 0.1.0, < 0.1.7 → 0.1.7
- 2026-09-29 [CVE-2026-102268](https://erroneo.us/security/cve/CVE-2026-102268/index.md) PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard — PyJWT <= 2.13.0 → 2.14.0
- 2026-09-24 [CVE-2026-61732](https://erroneo.us/security/cve/CVE-2026-61732/index.md) Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context — decepticon-core <= 1.1.16 → 1.1.17; decepticon <= 1.1.16 → 1.1.17; decepticon-sdk <= 1.1.16 → 1.1.17
- 2026-09-23 [CVE-2026-57149](https://erroneo.us/security/cve/CVE-2026-57149/index.md) plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection — plone.app.portlets >= 7.0.0, <= 7.0.1 → 7.0.2; plone.app.portlets >= 6.0.0, <= 6.0.3 → 6.0.4; plone.app.portlets >= 5.0.0, <= 5.0.7 → 5.0.8
- 2026-09-22 [CVE-2026-91130](https://erroneo.us/security/cve/CVE-2026-91130/index.md) Home Assistant: XSS in Statistics Graph Card — homeassistant < 2026.7.0 → 2026.7.0
- 2026-09-22 [CVE-2026-77244](https://erroneo.us/security/cve/CVE-2026-77244/index.md) [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token — mcp-atlassian < 0.22.0 → 0.22.0
- 2026-09-22 [CVE-2026-85734](https://erroneo.us/security/cve/CVE-2026-85734/index.md) lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks — lightrag-hku < 1.5.5 → 1.5.5
- 2026-09-18 [CVE-2026-59163](https://erroneo.us/security/cve/CVE-2026-59163/index.md) Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass — mnemosyne-memory <= 3.10.0 → 3.10.1
- 2026-09-18 [CVE-2026-63374](https://erroneo.us/security/cve/CVE-2026-63374/index.md) AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing — anyio < 4.14.2 → 4.14.2
- 2026-09-18 [CVE-2025-66455](https://erroneo.us/security/cve/CVE-2025-66455/index.md) LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py — lmdeploy >= 0.9.2, < 0.16.0 → 0.16.0
- 2026-09-16 [CVE-2026-61594](https://erroneo.us/security/cve/CVE-2026-61594/index.md) djust has an authorization bypass on the WebSocket/SSE mount path — djust < 1.0.7 → 1.0.7
- 2026-09-16 [CVE-2025-59953](https://erroneo.us/security/cve/CVE-2025-59953/index.md) LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy — lmdeploy >= 0.9.1, < 0.10.2 → 0.10.2
- 2026-09-14 [CVE-2026-59178](https://erroneo.us/security/cve/CVE-2026-59178/index.md) ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade — esphome-device-builder < 1.0.12 → 1.0.12
- 2026-09-11 [CVE-2026-59971](https://erroneo.us/security/cve/CVE-2026-59971/index.md) MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) — mysql-mcp-server < 0.4.2 → 0.4.2
- 2026-09-11 [CVE-2026-59151](https://erroneo.us/security/cve/CVE-2026-59151/index.md) Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover — prowler-cloud < 5.30.3 → 5.30.3
- 2026-09-08 [CVE-2026-79657](https://erroneo.us/security/cve/CVE-2026-79657/index.md) NLTK: Allowlisted pickle loaders still permit code execution in current source — nltk <= 3.10.2 → 3.10.3
- 2026-09-08 [CVE-2026-78683](https://erroneo.us/security/cve/CVE-2026-78683/index.md) NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution — nltk <= 3.9.4 → 3.10.0
- 2026-09-08 [CVE-2026-78676](https://erroneo.us/security/cve/CVE-2026-78676/index.md) GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE — GitPython <= 3.1.58 → 3.1.59
- 2026-09-03 [CVE-2026-71428](https://erroneo.us/security/cve/CVE-2026-71428/index.md) unstructured: Server-Side Request Forgery in the URL-based partitioning — unstructured >= 0.4.7, < 0.24.0 → 0.24.0
- 2026-09-03 [CVE-2026-85394](https://erroneo.us/security/cve/CVE-2026-85394/index.md) python-jose algorithm confusion guard bypassed by DER-encoded public keys — python-jose <= 3.5.0 → no fix
- 2026-09-02 [CVE-2026-62674](https://erroneo.us/security/cve/CVE-2026-62674/index.md) Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE — omnigent < 0.3.0 → 0.3.0
- 2026-09-01 [CVE-2026-79675](https://erroneo.us/security/cve/CVE-2026-79675/index.md) NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) — nltk <= 3.10.2 → 3.10.3
- 2026-08-28 [CVE-2026-55248](https://erroneo.us/security/cve/CVE-2026-55248/index.md) plone.app.portlets vulnerable to denial of service via RSS feed portlet — plone.app.portlets >= 7.0.0, <= 7.0.1 → 7.0.2; plone.app.portlets >= 6.0.0, < 6.0.4 → 6.0.4; plone.app.portlets < 5.0.8 → 5.0.8
- 2026-08-28 [CVE-2026-55247](https://erroneo.us/security/cve/CVE-2026-55247/index.md) plone.app.event vulnerable to denial of service via iCalendar import — plone.app.event < 5.2.4 → 5.2.4; plone.app.event >= 6.0.0a1, < 6.0.1 → 6.0.1
- 2026-08-27 [CVE-2026-37004](https://erroneo.us/security/cve/CVE-2026-37004/index.md) LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint — litellm < 1.83.7 → 1.83.7
- 2026-08-26 [CVE-2026-54569](https://erroneo.us/security/cve/CVE-2026-54569/index.md) senaite.core Vulnerable to Eval Injection and Missing Authorization — senaite.core >= 2.0.0, <= 2.6.0 → no fix
- 2026-08-26 [GHSA-93qj-5q5v-3c2h](https://erroneo.us/security/ghsa/GHSA-93qj-5q5v-3c2h/index.md) Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise) — pantheon-agents >= 0.6.1, <= 0.6.2 → 0.6.4
- 2026-08-25 [CVE-2026-45018](https://erroneo.us/security/cve/CVE-2026-45018/index.md) Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution — chainlit >= 2.4.0rc0, <= 2.11.1 → 2.12.0
- 2026-08-25 [CVE-2026-55546](https://erroneo.us/security/cve/CVE-2026-55546/index.md) qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input — qwed-mcp < 0.2.1 → 0.2.1
- 2026-08-25 [CVE-2026-55640](https://erroneo.us/security/cve/CVE-2026-55640/index.md) nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) — nextcloud-mcp-server <= 0.117.1 → 0.117.2
- 2026-08-25 [CVE-2026-55536](https://erroneo.us/security/cve/CVE-2026-55536/index.md) PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) — PraisonAI < 4.6.58 → 4.6.58
- 2026-08-24 [CVE-2026-53710](https://erroneo.us/security/cve/CVE-2026-53710/index.md) mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server — mcp-contextforge-gateway <= 1.0.1 → 1.0.2
- 2026-08-21 [CVE-2026-61539](https://erroneo.us/security/cve/CVE-2026-61539/index.md) Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing — xinference <= 2.5.0 → 2.7.0
- 2026-08-18 [CVE-2026-55211](https://erroneo.us/security/cve/CVE-2026-55211/index.md) surfio has an out-of-bounds read — surfio < 0.0.19 → 0.0.19
- 2026-08-18 [CVE-2026-55209](https://erroneo.us/security/cve/CVE-2026-55209/index.md) resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read — resdata < 6.2.9 → 6.2.9
- 2026-08-17 [CVE-2026-64849](https://erroneo.us/security/cve/CVE-2026-64849/index.md) MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) — mlflow >= 3.3.0, < 3.15.0 → 3.15.0
- 2026-07-31 [CVE-2026-68770](https://erroneo.us/security/cve/CVE-2026-68770/index.md) sentence-transformers local model loading bypasses trust_remote_code and executes custom Python — sentence-transformers < 5.6.0 → 5.6.0
- 2026-07-30 [CVE-2026-67426](https://erroneo.us/security/cve/CVE-2026-67426/index.md) Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration — flyto-core >= 2.26.6, < 2.26.7 → 2.26.7
- 2026-07-30 [CVE-2026-67429](https://erroneo.us/security/cve/CVE-2026-67429/index.md) Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) — flyto-core < 2.26.7 → 2.26.7
- 2026-07-21 [CVE-2026-64825](https://erroneo.us/security/cve/CVE-2026-64825/index.md) Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding — homeassistant < 2026.6.0 → 2026.6.0
- 2026-07-20 [CVE-2026-61740](https://erroneo.us/security/cve/CVE-2026-61740/index.md) LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection — lightrag-hku < 1.5.4 → 1.5.4
- 2026-07-20 [CVE-2026-61736](https://erroneo.us/security/cve/CVE-2026-61736/index.md) LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests — lightrag-hku <= 1.5.3 → 1.5.4
- 2026-07-16 [CVE-2026-15925](https://erroneo.us/security/cve/CVE-2026-15925/index.md) Snowflake Connector for Python improperly verifies TLS hostnames — snowflake-connector-python < 3.18.1 → 3.18.1; snowflake-connector-python >= 4.0.0, < 4.7.1 → 4.7.1
- 2026-07-15 [CVE-2025-65720](https://erroneo.us/security/cve/CVE-2025-65720/index.md) GPT Researcher MCP STDIO configuration allows remote command execution — gpt-researcher >= 0.14.5, <= 0.14.7 → no fix
- 2026-07-13 [CVE-2026-61667](https://erroneo.us/security/cve/CVE-2026-61667/index.md) DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval — DIRAC >= 6, < 8.0.79 → 8.0.79; DIRAC >= 8.1.0a1, < 9.0.22 → 9.0.22; DIRAC >= 9.1.0, < 9.1.10 → 9.1.10
- 2026-07-13 [CVE-2026-45579](https://erroneo.us/security/cve/CVE-2026-45579/index.md) DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input — DIRAC >= 6, < 8.0.79 → 8.0.79; DIRAC >= 8.1.0a1, < 9.0.22 → 9.0.22; DIRAC >= 9.1.0, < 9.1.10 → 9.1.10
- 2026-07-10 [CVE-2026-61459](https://erroneo.us/security/cve/CVE-2026-61459/index.md) mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials — mcp-server-kubernetes < 3.9.0 → 3.9.0
- 2026-07-07 [CVE-2026-58473](https://erroneo.us/security/cve/CVE-2026-58473/index.md) Cognee allows non-superusers to overwrite global LLM configuration — cognee < 1.5.0 → 1.5.0
- 2026-07-07 [CVE-2026-33264](https://erroneo.us/security/cve/CVE-2026-33264/index.md) Apache Airflow allows code execution through unsafe serialized DAG deserialization — apache-airflow < 3.3.0 → 3.3.0
- 2026-07-06 [CVE-2026-54769](https://erroneo.us/security/cve/CVE-2026-54769/index.md) Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent — langroid <= 0.65.1 → 0.65.2
- 2026-07-06 [CVE-2026-54760](https://erroneo.us/security/cve/CVE-2026-54760/index.md) Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls — langroid <= 0.65.0 → 0.65.1
- 2026-07-06 [CVE-2026-55615](https://erroneo.us/security/cve/CVE-2026-55615/index.md) Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 — langroid <= 0.65.4 → 0.65.5
- 2026-07-02 [CVE-2026-52830](https://erroneo.us/security/cve/CVE-2026-52830/index.md) fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection — fast-mcp-telegram <= 0.19.0 → 0.19.1
- 2026-07-02 [CVE-2026-50027](https://erroneo.us/security/cve/CVE-2026-50027/index.md) mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete — mcp-memory-service < 10.67.1 → 10.67.1
- 2026-06-26 [CVE-2026-48797](https://erroneo.us/security/cve/CVE-2026-48797/index.md) Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication — backpropagate >= 1.1.0, < 1.2.0 → 1.2.0; @mcptoolshop/backpropagate >= 1.1.0, < 1.2.0 → 1.2.0
- 2026-06-26 [GHSA-98x5-vq43-vc5p](https://erroneo.us/security/ghsa/GHSA-98x5-vq43-vc5p/index.md) semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin — semantic-router >= 0.1.8, < 0.1.15 → 0.1.15
- 2026-06-26 [CVE-2026-49257](https://erroneo.us/security/cve/CVE-2026-49257/index.md) mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind — mcp-pinot-server <= 3.0.1 → 3.1.0
- 2026-06-25 [CVE-2026-55166](https://erroneo.us/security/cve/CVE-2026-55166/index.md) Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise — lemur < 1.9.2 → 1.9.2
- 2026-06-23 [GHSA-qxvg-h7q2-hcxh](https://erroneo.us/security/ghsa/GHSA-qxvg-h7q2-hcxh/index.md) motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) — motioneye < 0.44.0 → 0.44.0
- 2026-06-23 [GHSA-phv5-334h-mxcw](https://erroneo.us/security/ghsa/GHSA-phv5-334h-mxcw/index.md) motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal — motioneye < 0.44.0 → 0.44.0
- 2026-06-22 [CVE-2026-46488](https://erroneo.us/security/cve/CVE-2026-46488/index.md) motionEye: Authentication possible via password hash — motioneye < 0.44.0 → 0.44.0
- 2026-06-22 [CVE-2026-56104](https://erroneo.us/security/cve/CVE-2026-56104/index.md) Chainlit contains a session hijacking vulnerability — chainlit < 2.10.1 → 2.10.1
- 2026-06-21 [CVE-2026-56265](https://erroneo.us/security/cve/CVE-2026-56265/index.md) Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server — crawl4ai < 0.8.7 → 0.8.7
- 2026-06-19 [CVE-2026-55447](https://erroneo.us/security/cve/CVE-2026-55447/index.md) Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit — langflow < 1.9.2 → 1.9.2
- 2026-06-18 [CVE-2026-57118](https://erroneo.us/security/cve/CVE-2026-57118/index.md) PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints — praisonaiagents < 1.6.59 → 1.6.59
- 2026-06-18 [CVE-2026-57123](https://erroneo.us/security/cve/CVE-2026-57123/index.md) PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in — praisonaiagents < 1.6.59 → 1.6.59
- 2026-06-18 [CVE-2026-47103](https://erroneo.us/security/cve/CVE-2026-47103/index.md) python-statemachine SCXML <data expr> Eval Injection — python-statemachine >= 3.0.0, < 3.2.0 → 3.2.0
- 2026-06-18 [GHSA-r253-r9jw-qg44](https://erroneo.us/security/ghsa/GHSA-r253-r9jw-qg44/index.md) Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args — crawl4ai <= 0.8.9 → 0.9.0
- 2026-06-18 [CVE-2026-57124](https://erroneo.us/security/cve/CVE-2026-57124/index.md) PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai — praisonai <= 4.6.48 → 4.6.59
- 2026-06-18 [CVE-2026-57127](https://erroneo.us/security/cve/CVE-2026-57127/index.md) praisonai: recipe serve auth middleware silently disables itself when no secret is set — praisonai <= 4.6.48 → 4.6.59
- 2026-06-18 [CVE-2026-57496](https://erroneo.us/security/cve/CVE-2026-57496/index.md) netlicensing-mcp: REST Path Traversal Bypasses Token Redaction — netlicensing-mcp < 0.1.8 → 0.1.8
- 2026-06-18 [CVE-2026-57131](https://erroneo.us/security/cve/CVE-2026-57131/index.md) PraisonAI: Jobs API exposes agent-execution endpoints with no authentication — praisonai < 4.6.59 → 4.6.59
- 2026-06-18 [CVE-2026-44727](https://erroneo.us/security/cve/CVE-2026-44727/index.md) Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP — jupyter-server <= 2.19.0 → 2.20.0
- 2026-06-18 [CVE-2026-57148](https://erroneo.us/security/cve/CVE-2026-57148/index.md) praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) — praisonai-platform <= 0.1.4 → 0.1.6
- 2026-06-18 [CVE-2026-57147](https://erroneo.us/security/cve/CVE-2026-57147/index.md) praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery — praisonai-platform <= 0.1.4 → 0.1.6
- 2026-06-18 [CVE-2026-57116](https://erroneo.us/security/cve/CVE-2026-57116/index.md) PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation — praisonai >= 4.2.1, <= 4.6.57 → 4.6.59
- 2026-06-18 [CVE-2026-57125](https://erroneo.us/security/cve/CVE-2026-57125/index.md) PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass — praisonai <= 4.6.48 → 4.6.59; praisonaiagents < 1.6.59 → 1.6.59
- 2026-06-18 [GHSA-2jq4-q6vv-4cp3](https://erroneo.us/security/ghsa/GHSA-2jq4-q6vv-4cp3/index.md) Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE — crawl4ai <= 0.8.9 → 0.9.0
- 2026-06-18 [CVE-2026-57145](https://erroneo.us/security/cve/CVE-2026-57145/index.md) PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation — praisonai < 4.6.61 → 4.6.61
- 2026-06-17 [CVE-2026-55450](https://erroneo.us/security/cve/CVE-2026-55450/index.md) Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak — langflow < 1.9.1 → 1.9.1
- 2026-06-17 [CVE-2026-50203](https://erroneo.us/security/cve/CVE-2026-50203/index.md) Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory — apache-airflow-providers-sftp < 5.8.1 → 5.8.1
- 2026-06-16 [CVE-2026-48519](https://erroneo.us/security/cve/CVE-2026-48519/index.md) Langflow: Unauthenticated RCE in Shareable Playgrounds — langflow <= 1.9.1 → 1.9.2
- 2026-06-16 [CVE-2026-53753](https://erroneo.us/security/cve/CVE-2026-53753/index.md) Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API — crawl4ai <= 0.8.6 → 0.8.7

Pages: https://erroneo.us/security/ecosystem/pypi/index.md · https://erroneo.us/security/ecosystem/pypi/2/index.md · https://erroneo.us/security/ecosystem/pypi/3/index.md · https://erroneo.us/security/ecosystem/pypi/4/index.md · https://erroneo.us/security/ecosystem/pypi/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/pypi/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt