pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resourc...

CVE-2026-119204

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsi

来源摘录 · NVD / GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference ...

CVE-2026-119203

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening

来源摘录 · NVD / GitHub Advisory

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the rema...

CVE-2026-119197

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at

来源摘录 · NVD / GitHub Advisory

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragme...

CVE-2026-119196

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copi

来源摘录 · NVD / GitHub Advisory

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes va...

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repe

来源摘录 · NVD / GitHub Advisory

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one...

CVE-2026-119194

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded

来源摘录 · NVD / GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthent

来源摘录 · GitHub Advisory

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

CVE-2026-61438

### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML

来源摘录 · GitHub Advisory

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

CVE-2026-115927

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have

来源摘录 · GitHub Advisory

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

CVE-2026-116578

### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a templa

来源摘录 · GitHub Advisory

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

CVE-2026-116577

### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obs

来源摘录 · GitHub Advisory

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

CVE-2026-116575

Summary _build_session_scope() in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the

历史摘要 · 未重新核验 · GitHub Advisory

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

CVE-2026-115910

### Summary The generic OpenID Connect backend (`OpenIdConnectAuth` and every backend built on it) stores the `nonce` i

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

CVE-2026-115920

## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than thr

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

CVE-2026-115922

## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor d

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

CVE-2026-115921

## Summary ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed va

历史摘要 · 未重新核验 · GitHub Advisory

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

CVE-2026-115919

## Summary ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from

历史摘要 · 未重新核验 · GitHub Advisory

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

CVE-2026-116690

### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote

历史摘要 · 未重新核验 · GitHub Advisory

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

CVE-2026-116691

### Summary `mlflow.crewai.autolog()` leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI `A

历史摘要 · 未重新核验 · GitHub Advisory

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

CVE-2026-116692

## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. Dur

历史摘要 · 未重新核验 · GitHub Advisory