---
title: AI-Agent News & Advisory Portal — security/library
canonical_url: https://portal.chinng-lab-srv.dev/feeds/security/library.md
content_kind: category-feed
updated_at: '2026-08-02T07:21:57Z'
---

# AI-Agent News & Advisory Portal — security/library

> Latest published articles in security/library.

- [GHSA-94p4-4cq8-9g67: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)](https://portal.chinng-lab-srv.dev/security/library/security-20260725-df0150.md): GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
- [GHSA-r9mr-m37c-5fr3: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution](https://portal.chinng-lab-srv.dev/security/library/security-20260725-d05ab6.md): GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
- [GHSA-6p8h-3wgx-97gf: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks](https://portal.chinng-lab-srv.dev/security/library/security-20260725-96fd04.md): GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
- [GHSA-fjr4-x663-mwxc: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)](https://portal.chinng-lab-srv.dev/security/library/security-20260725-aa9760.md): GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
- [GHSA-3rp5-jjmw-4wv2: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)](https://portal.chinng-lab-srv.dev/security/library/security-20260725-bc7367.md): GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
- [CVE-2026-61632: PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path](https://portal.chinng-lab-srv.dev/security/library/security-20260725-6eddf9.md): PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
- [CVE-2026-59819: LiteLLM: Local file read via request-supplied OIDC file references](https://portal.chinng-lab-srv.dev/security/library/security-20260724-34de13.md): LiteLLM: Local file read via request-supplied OIDC file references
- [CVE-2026-59820: LiteLLM: Arbitrary file write via path traversal in Skills archive extraction](https://portal.chinng-lab-srv.dev/security/library/security-20260724-5fecae.md): LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
- [CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks](https://portal.chinng-lab-srv.dev/security/library/security-20260724-cfd1d4.md): LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
- [CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback](https://portal.chinng-lab-srv.dev/security/library/security-20260724-819d64.md): LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
- [CVE-2026-59200: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()](https://portal.chinng-lab-srv.dev/security/library/security-20260724-bc2416.md): Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- [CVE-2026-59204: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service](https://portal.chinng-lab-srv.dev/security/library/security-20260724-51d556.md): Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- [CVE-2026-54058: Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)](https://portal.chinng-lab-srv.dev/security/library/security-20260724-2a8214.md): Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- [CVE-2026-59198: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images](https://portal.chinng-lab-srv.dev/security/library/security-20260724-a8f0ed.md): Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
- [CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks](https://portal.chinng-lab-srv.dev/security/library/security-20260724-13fb1a.md): MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
- [CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal](https://portal.chinng-lab-srv.dev/security/library/security-20260724-270802.md): MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- [CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation](https://portal.chinng-lab-srv.dev/security/library/security-20260724-2aafed.md): MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- [CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks](https://portal.chinng-lab-srv.dev/security/library/security-20260723-537f58.md): LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
- [CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback](https://portal.chinng-lab-srv.dev/security/library/security-20260723-9fd6c7.md): LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
- [CVE-2026-59819: LiteLLM: Local file read via request-supplied OIDC file references](https://portal.chinng-lab-srv.dev/security/library/security-20260723-c85540.md): LiteLLM: Local file read via request-supplied OIDC file references
- [CVE-2026-59820: LiteLLM: Arbitrary file write via path traversal in Skills archive extraction](https://portal.chinng-lab-srv.dev/security/library/security-20260723-65e0c5.md): LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
- [CVE-2026-67322: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL](https://portal.chinng-lab-srv.dev/security/library/security-20260722-bdbe76.md): GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
- [CVE-2026-67323: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`](https://portal.chinng-lab-srv.dev/security/library/security-20260722-f9f263.md): GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
- [CVE-2026-67325: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist](https://portal.chinng-lab-srv.dev/security/library/security-20260722-96cbaf.md): GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
- [CVE-2026-59890: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+](https://portal.chinng-lab-srv.dev/security/library/security-20260722-ba03c4.md): setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- [CVE-2026-59205: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch](https://portal.chinng-lab-srv.dev/security/library/security-20260721-9c81bc.md): Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
- [CVE-2026-59204: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service](https://portal.chinng-lab-srv.dev/security/library/security-20260721-e02209.md): Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- [CVE-2026-59203: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service](https://portal.chinng-lab-srv.dev/security/library/security-20260721-941bc6.md): Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
- [CVE-2026-59200: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()](https://portal.chinng-lab-srv.dev/security/library/security-20260721-3aa418.md): Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- [CVE-2026-59199: Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow](https://portal.chinng-lab-srv.dev/security/library/security-20260721-ca974b.md): Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
- [CVE-2026-59198: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images](https://portal.chinng-lab-srv.dev/security/library/security-20260721-48da14.md): Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
- [CVE-2026-59197: Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`](https://portal.chinng-lab-srv.dev/security/library/security-20260721-871179.md): Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
- [CVE-2026-55798: Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path](https://portal.chinng-lab-srv.dev/security/library/security-20260721-054ec0.md): Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
- [CVE-2026-55380: Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`](https://portal.chinng-lab-srv.dev/security/library/security-20260721-4fa7c9.md): Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
- [CVE-2026-55379: Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading](https://portal.chinng-lab-srv.dev/security/library/security-20260721-d74706.md): Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
- [CVE-2026-54060: Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`](https://portal.chinng-lab-srv.dev/security/library/security-20260721-a1dd3d.md): Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
- [CVE-2026-54059: Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading](https://portal.chinng-lab-srv.dev/security/library/security-20260721-f6d04d.md): Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
- [CVE-2026-54058: Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)](https://portal.chinng-lab-srv.dev/security/library/security-20260721-6fab85.md): Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- [CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation](https://portal.chinng-lab-srv.dev/security/library/security-20260717-da152e.md): MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- [CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal](https://portal.chinng-lab-srv.dev/security/library/security-20260717-f4f0b5.md): MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- [CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks](https://portal.chinng-lab-srv.dev/security/library/security-20260717-e2a08b.md): MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
- [CVE-2026-59197 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260723-e5b374.md): Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilt…
- [CVE-2026-59203 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260716-a3f93e.md): Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file…
- [CVE-2026-59205 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260716-51776c.md): Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image wh…
- [CVE-2026-59199 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260716-ec2875.md): Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in…
- [GHSA-xf7x-x43h-rpqh: json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS](https://portal.chinng-lab-srv.dev/security/library/security-20260714-fc7931.md): json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS
- [CVE-2026-47102: LiteLLM allows a user to modify their own user_role via the /user/update endpoint](https://portal.chinng-lab-srv.dev/security/library/security-20260714-af08b2.md): LiteLLM allows a user to modify their own user_role via the /user/update endpoint
- [CVE-2026-47101: LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit](https://portal.chinng-lab-srv.dev/security/library/security-20260714-3ea518.md): LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
- [CVE-2026-46338: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path](https://portal.chinng-lab-srv.dev/security/library/security-20260714-1498ce.md): Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
- [CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)](https://portal.chinng-lab-srv.dev/security/library/security-20260714-3d3887.md): Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
- [CVE-2026-7597: mem0ai mem0 has an Improper Input Validation Issue](https://portal.chinng-lab-srv.dev/security/library/security-20260714-5e3c46.md): mem0ai mem0 has an Improper Input Validation Issue
- [CVE-2026-6357: pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere](https://portal.chinng-lab-srv.dev/security/library/security-20260714-36ddaf.md): pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
- [CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files](https://portal.chinng-lab-srv.dev/security/library/security-20260714-2b057f.md): pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
- [CVE-2026-35029: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint](https://portal.chinng-lab-srv.dev/security/library/security-20260714-eacbed.md): LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
- [CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI](https://portal.chinng-lab-srv.dev/security/library/security-20260714-ea9700.md): FastMCP has a Command Injection vulnerability - Gemini CLI
- [CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities](https://portal.chinng-lab-srv.dev/security/library/security-20260714-cd6e93.md): FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
- [CVE-2026-4539: Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching](https://portal.chinng-lab-srv.dev/security/library/security-20260714-b013cc.md): Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
- [CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers](https://portal.chinng-lab-srv.dev/security/library/security-20260714-505be9.md): FastMCP OAuth Proxy token reuse across MCP servers
- [CVE-2026-59890 — setuptools](https://portal.chinng-lab-srv.dev/security/library/security-20260715-584ebf.md): setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude…
- [CVE-2026-1703: pip Path Traversal vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260711-23efcc.md): pip Path Traversal vulnerability
- [CVE-2025-71176: pytest has vulnerable tmpdir handling](https://portal.chinng-lab-srv.dev/security/library/security-20260711-540cbb.md): pytest has vulnerable tmpdir handling
- [CVE-2026-24049: Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack](https://portal.chinng-lab-srv.dev/security/library/security-20260711-ccb793.md): Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
- [CVE-2025-62800: FastMCP vulnerable to reflected XSS in client's callback page](https://portal.chinng-lab-srv.dev/security/library/security-20260708-c8a727.md): FastMCP vulnerable to reflected XSS in client's callback page
- [CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name](https://portal.chinng-lab-srv.dev/security/library/security-20260708-acd1c4.md): FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
- [CVE-2025-62727: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``](https://portal.chinng-lab-srv.dev/security/library/security-20260711-dc1ff3.md): Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
- [CVE-2025-8869: pip's fallback tar extraction doesn't check symbolic links point to extraction directory](https://portal.chinng-lab-srv.dev/security/library/security-20260711-0a6e6e.md): pip's fallback tar extraction doesn't check symbolic links point to extraction directory
- [CVE-2025-54121: Starlette has possible denial-of-service vector when parsing large files in multipart forms](https://portal.chinng-lab-srv.dev/security/library/security-20260711-aa726f.md): Starlette has possible denial-of-service vector when parsing large files in multipart forms
- [CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs](https://portal.chinng-lab-srv.dev/security/library/security-20260708-caa7d4.md): Requests vulnerable to .netrc credentials leak via malicious URLs
- [CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False](https://portal.chinng-lab-srv.dev/security/library/security-20260711-abfd3a.md): Requests `Session` object does not verify requests after making first request with verify=False
- [CVE-2026-54059 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-27b2a1.md): Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without callin…
- [CVE-2026-54060 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-3d7d29.md): Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._de…
- [CVE-2026-55379 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-f7ab82.md): Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() wi…
- [CVE-2026-55380 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-cb6737.md): Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompres…
- [CVE-2026-55798 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-e41644.md): Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the…
- [CVE-2026-9547: SSH improper host validation](https://portal.chinng-lab-srv.dev/security/library/security-20260709-b7cfc2.md): SSH improper host validation
- [CVE-2026-9079: stale proxy password leak](https://portal.chinng-lab-srv.dev/security/library/security-20260709-7b9856.md): stale proxy password leak
- [CVE-2026-8932: incomplete mTLS config matching in conn reuse](https://portal.chinng-lab-srv.dev/security/library/security-20260709-481e8f.md): incomplete mTLS config matching in conn reuse
- [CVE-2026-8927: env-set cross-proxy Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260709-c31b3d.md): env-set cross-proxy Digest auth state leak
- [CVE-2026-8924: trailing dot domain super cookie](https://portal.chinng-lab-srv.dev/security/library/security-20260709-d4a2ba.md): trailing dot domain super cookie
- [CVE-2026-8458: wrong reuse for different services](https://portal.chinng-lab-srv.dev/security/library/security-20260709-d90476.md): wrong reuse for different services
- [CVE-2026-8286: wrong STARTTLS connection reuse](https://portal.chinng-lab-srv.dev/security/library/security-20260709-594d76.md): wrong STARTTLS connection reuse
- [CVE-2026-12064: proto-default skips SSH verification](https://portal.chinng-lab-srv.dev/security/library/security-20260709-110ac1.md): proto-default skips SSH verification
- [CVE-2026-11856: cross-origin Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260709-5f38ce.md): cross-origin Digest auth state leak
- [CVE-2026-10536: HTTP/2 stream-dependency tree UAF](https://portal.chinng-lab-srv.dev/security/library/security-20260709-121c98.md): HTTP/2 stream-dependency tree UAF
- [CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection](https://portal.chinng-lab-srv.dev/security/library/security-20260711-1179e0.md): LiteLLM: Authentication Bypass via Host Header Injection
- [CVE-2026-45829: ChromaDB Python project has a pre-authentication code injection vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260711-6be3b2.md): ChromaDB Python project has a pre-authentication code injection vulnerability
- [CVE-2026-35030: LiteLLM: Authentication bypass via OIDC userinfo cache key collision](https://portal.chinng-lab-srv.dev/security/library/security-20260711-c3dbc4.md): LiteLLM: Authentication bypass via OIDC userinfo cache key collision
- [CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260705-4ba576.md): FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- [CVE-2026-10536: HTTP/2 stream-dependency tree UAF](https://portal.chinng-lab-srv.dev/security/library/security-20260705-17fe1f.md): HTTP/2 stream-dependency tree UAF
- [CVE-2026-11856: cross-origin Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-0bdb31.md): cross-origin Digest auth state leak
- [CVE-2026-12064: proto-default skips SSH verification](https://portal.chinng-lab-srv.dev/security/library/security-20260705-f8defc.md): proto-default skips SSH verification
- [CVE-2026-8286: wrong STARTTLS connection reuse](https://portal.chinng-lab-srv.dev/security/library/security-20260705-3b52df.md): wrong STARTTLS connection reuse
- [CVE-2026-8458: wrong reuse for different services](https://portal.chinng-lab-srv.dev/security/library/security-20260705-b2753c.md): wrong reuse for different services
- [CVE-2026-8924: trailing dot domain super cookie](https://portal.chinng-lab-srv.dev/security/library/security-20260705-96497a.md): trailing dot domain super cookie
- [CVE-2026-8927: env-set cross-proxy Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-c9a7a6.md): env-set cross-proxy Digest auth state leak
- [CVE-2026-8932: incomplete mTLS config matching in conn reuse](https://portal.chinng-lab-srv.dev/security/library/security-20260705-cbda47.md): incomplete mTLS config matching in conn reuse
- [CVE-2026-9079: stale proxy password leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-f5d43e.md): stale proxy password leak
- [CVE-2026-9547: SSH improper host validation](https://portal.chinng-lab-srv.dev/security/library/security-20260705-536aef.md): SSH improper host validation
- [CVE-2026-54275 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260711-347a7c.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an applica…
- [CVE-2026-54282 — starlette](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d36fb6.md): Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating…
- [CVE-2026-54283 — starlette](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d980d5.md): Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are…
- [CVE-2026-54276 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-dcbe9c.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This…
- [CVE-2026-54277 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-b8656e.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using…
- [CVE-2026-54278 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-bacc5b.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chun…
- [CVE-2026-54279 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-1775ac.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() l…
- [CVE-2026-54280 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-46393e.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a pa…
- [CVE-2026-54273 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-e1a21e.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able…
- [CVE-2026-54274 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-cf3c24.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual…
- [CVE-2026-50269 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-ad7e36.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to i…
- [CVE-2026-58203: pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size](https://portal.chinng-lab-srv.dev/security/library/security-20260711-ffc947.md): pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
- [CVE-2026-59152: LangSmith SDK TracingMiddleware: Arbitrary server-side file read](https://portal.chinng-lab-srv.dev/security/library/security-20260711-e59ea6.md): LangSmith SDK TracingMiddleware: Arbitrary server-side file read
- [CVE-2026-57585: MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error](https://portal.chinng-lab-srv.dev/security/library/security-20260711-cdb45c.md): MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
- [CVE-2026-48817 — starlette](https://portal.chinng-lab-srv.dev/security/library/security-20260714-52fc4b.md): Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an att…
- [CVE-2026-48818 — starlette](https://portal.chinng-lab-srv.dev/security/library/security-20260714-163dc6.md): Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to…
- [CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header Injection](https://portal.chinng-lab-srv.dev/security/library/security-20260711-af5d1c.md): LiteLLM: Authentication Bypass via Host Header Injection
- [CVE-2026-54283: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS](https://portal.chinng-lab-srv.dev/security/library/security-20260711-e1d2eb.md): Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
- [CVE-2026-54282: Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname](https://portal.chinng-lab-srv.dev/security/library/security-20260711-b55652.md): Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
- [CVE-2026-48818: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows](https://portal.chinng-lab-srv.dev/security/library/security-20260711-8dd28c.md): Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- [CVE-2026-48817: Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`](https://portal.chinng-lab-srv.dev/security/library/security-20260711-fa0f6a.md): Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
- [CVE-2026-54274: aiohttp: Incomplete websocket frame payloads bypass memory limits](https://portal.chinng-lab-srv.dev/security/library/security-20260711-ae9caf.md): aiohttp: Incomplete websocket frame payloads bypass memory limits
- [CVE-2026-54275: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections](https://portal.chinng-lab-srv.dev/security/library/security-20260711-62a631.md): aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
- [CVE-2026-54280: aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a86bd4.md): aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
- [CVE-2026-54273: aiohttp: HTTP/1 Pipelined Requests Queue Without Limit](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f88f5e.md): aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
- [CVE-2026-54278: aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup](https://portal.chinng-lab-srv.dev/security/library/security-20260711-724d0b.md): aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
- [CVE-2026-54277: aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines](https://portal.chinng-lab-srv.dev/security/library/security-20260711-519445.md): aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
- [CVE-2026-54276: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a38446.md): aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
- [CVE-2026-54279: aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence](https://portal.chinng-lab-srv.dev/security/library/security-20260711-546e87.md): aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
- [CVE-2026-50269: aiohttp: CRLF injection in multipart headers](https://portal.chinng-lab-srv.dev/security/library/security-20260711-149a61.md): aiohttp: CRLF injection in multipart headers
- [CVE-2026-45409 — idna](https://portal.chinng-lab-srv.dev/security/library/security-20260711-3d84c1.md): Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prio…
- [CVE-2026-48710: Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks](https://portal.chinng-lab-srv.dev/security/library/security-20260711-4f7f03.md): Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
- [CVE-2026-47265: AIOHTTP is vulnerable to cross-origin redirect with per-request cookies](https://portal.chinng-lab-srv.dev/security/library/security-20260711-50a642.md): AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
- [CVE-2026-34993: AIOHTTP is Vulnerable to Deserialization of Untrusted Data](https://portal.chinng-lab-srv.dev/security/library/security-20260711-900f4a.md): AIOHTTP is Vulnerable to Deserialization of Untrusted Data
- [CVE-2026-47265 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-ce4cf5.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin r…
- [CVE-2026-34993 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-ce6a2b.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most appli…
- [CVE-2026-8643: pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory](https://portal.chinng-lab-srv.dev/security/library/security-20260711-dccc73.md): pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
- [CVE-2026-8643 — pip](https://portal.chinng-lab-srv.dev/security/library/security-20260711-4047e8.md): pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed out…
- [CVE-2026-48710: BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks](https://portal.chinng-lab-srv.dev/security/library/security-20260711-0ca3e6.md): BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
- [CVE-2026-47102: LiteLLM allows a user to modify their own user_role via the /user/update endpoint](https://portal.chinng-lab-srv.dev/security/library/security-20260711-30590f.md): LiteLLM allows a user to modify their own user_role via the /user/update endpoint
- [CVE-2026-47101: LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit](https://portal.chinng-lab-srv.dev/security/library/security-20260711-9ab91d.md): LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
- [CVE-2026-46338: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f86029.md): Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
- [CVE-2026-45409: Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix](https://portal.chinng-lab-srv.dev/security/library/security-20260711-3ab8f0.md): Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
- [CVE-2026-45829: ChromaDB Python project has a pre-authentication code injection vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260711-aac494.md): ChromaDB Python project has a pre-authentication code injection vulnerability
- [CVE-2026-44431 — urllib3](https://portal.chinng-lab-srv.dev/security/library/security-20260711-2db6ef.md): urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fa…
- [CVE-2026-44432 — urllib3](https://portal.chinng-lab-srv.dev/security/library/security-20260711-10a0ef.md): urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) c…
- [CVE-2026-7168: cross-proxy Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260708-195fe4.md): cross-proxy Digest auth state leak
- [CVE-2026-6429: netrc credential leak with reused proxy connection](https://portal.chinng-lab-srv.dev/security/library/security-20260708-9ae53f.md): netrc credential leak with reused proxy connection
- [CVE-2026-6276: stale custom cookie host causes cookie leak](https://portal.chinng-lab-srv.dev/security/library/security-20260708-ca0560.md): stale custom cookie host causes cookie leak
- [CVE-2026-6253: proxy credentials leak over redirect-to proxy](https://portal.chinng-lab-srv.dev/security/library/security-20260708-8cf62f.md): proxy credentials leak over redirect-to proxy
- [CVE-2026-5773: wrong reuse of SMB connection](https://portal.chinng-lab-srv.dev/security/library/security-20260708-c317fd.md): wrong reuse of SMB connection
- [CVE-2026-5545: wrong reuse of HTTP Negotiate connection](https://portal.chinng-lab-srv.dev/security/library/security-20260708-8a5880.md): wrong reuse of HTTP Negotiate connection
- [CVE-2026-4873: connection reuse ignores TLS requirement](https://portal.chinng-lab-srv.dev/security/library/security-20260708-793ccb.md): connection reuse ignores TLS requirement
- [CVE-2026-44432: urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d45cff.md): urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- [CVE-2026-44431: urllib3: Sensitive headers forwarded across origins in proxied low-level redirects](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f7ce82.md): urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
- [CVE-2026-42309 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-388e4d.md): Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polyg…
- [CVE-2026-42311 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-c572fa.md): Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code e…
- [CVE-2026-42308 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260711-dad7c4.md): Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer…
- [CVE-2026-67326: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath](https://portal.chinng-lab-srv.dev/security/library/security-20260711-fad306.md): GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
- [CVE-2026-44243 — gitpython](https://portal.chinng-lab-srv.dev/security/library/security-20260714-452cd1.md): GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application…
- [CVE-2026-44244 — gitpython](https://portal.chinng-lab-srv.dev/security/library/security-20260714-6a196b.md): GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitP…
- [CVE-2026-42215 — gitpython](https://portal.chinng-lab-srv.dev/security/library/security-20260714-a28fde.md): GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by…
- [CVE-2026-42284 — gitpython](https://portal.chinng-lab-srv.dev/security/library/security-20260714-3d4f5e.md): GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)…
- [CVE-2026-44244: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f47f64.md): GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
- [CVE-2026-44243: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository](https://portal.chinng-lab-srv.dev/security/library/security-20260711-5bcc98.md): GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
- [CVE-2026-42311: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)](https://portal.chinng-lab-srv.dev/security/library/security-20260711-6ac13d.md): Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
- [CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)](https://portal.chinng-lab-srv.dev/security/library/security-20260711-96bbde.md): Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
- [CVE-2026-42308: Pillow has an integer overflow when processing fonts](https://portal.chinng-lab-srv.dev/security/library/security-20260711-202b54.md): Pillow has an integer overflow when processing fonts
- [CVE-2026-42309: Pillow has a heap buffer overflow with nested list coordinates](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a57b4f.md): Pillow has a heap buffer overflow with nested list coordinates
- [CVE-2026-7597: mem0ai mem0 has an Improper Input Validation Issue](https://portal.chinng-lab-srv.dev/security/library/security-20260711-2e1fd9.md): mem0ai mem0 has an Improper Input Validation Issue
- [CVE-2026-7246 — click](https://portal.chinng-lab-srv.dev/security/library/security-20260714-8d098b.md): Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- [CVE-2026-4873: connection reuse ignores TLS requirement](https://portal.chinng-lab-srv.dev/security/library/security-20260705-7a3f68.md): connection reuse ignores TLS requirement
- [CVE-2026-5545: wrong reuse of HTTP Negotiate connection](https://portal.chinng-lab-srv.dev/security/library/security-20260705-4d15b8.md): wrong reuse of HTTP Negotiate connection
- [CVE-2026-5773: wrong reuse of SMB connection](https://portal.chinng-lab-srv.dev/security/library/security-20260705-5feff9.md): wrong reuse of SMB connection
- [CVE-2026-6253: proxy credentials leak over redirect-to proxy](https://portal.chinng-lab-srv.dev/security/library/security-20260705-72d76e.md): proxy credentials leak over redirect-to proxy
- [CVE-2026-6276: stale custom cookie host causes cookie leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-0f107d.md): stale custom cookie host causes cookie leak
- [CVE-2026-6429: netrc credential leak with reused proxy connection](https://portal.chinng-lab-srv.dev/security/library/security-20260705-943a84.md): netrc credential leak with reused proxy connection
- [CVE-2026-7168: cross-proxy Digest auth state leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-78325e.md): cross-proxy Digest auth state leak
- [CVE-2026-6357: pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere](https://portal.chinng-lab-srv.dev/security/library/security-20260711-1aac96.md): pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
- [CVE-2026-42215: GitPython has Command Injection via Git options bypass](https://portal.chinng-lab-srv.dev/security/library/security-20260711-603762.md): GitPython has Command Injection via Git options bypass
- [CVE-2026-42284: GitPython: Unsafe option check validates multi_options before shlex.split transformation](https://portal.chinng-lab-srv.dev/security/library/security-20260711-70130c.md): GitPython: Unsafe option check validates multi_options before shlex.split transformation
- [CVE-2026-41066 — lxml](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d6cb41.md): lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML in…
- [CVE-2026-41066: lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a46103.md): lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
- [CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a0d84f.md): pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
- [CVE-2026-40192 — pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260714-f651a5.md): Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attac…
- [CVE-2026-40192: FITS GZIP decompression bomb in Pillow](https://portal.chinng-lab-srv.dev/security/library/security-20260711-42df7e.md): FITS GZIP decompression bomb in Pillow
- [GHSA-69x8-hrgq-fjj8: LiteLLM: Password hash exposure and pass-the-hash authentication bypass](https://portal.chinng-lab-srv.dev/security/library/security-20260711-40da24.md): LiteLLM: Password hash exposure and pass-the-hash authentication bypass
- [CVE-2026-35030: LiteLLM: Authentication bypass via OIDC userinfo cache key collision](https://portal.chinng-lab-srv.dev/security/library/security-20260711-0c3e20.md): LiteLLM: Authentication bypass via OIDC userinfo cache key collision
- [CVE-2026-35029: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint](https://portal.chinng-lab-srv.dev/security/library/security-20260711-8de0b3.md): LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
- [CVE-2026-34525: AIOHTTP accepts duplicate Host headers](https://portal.chinng-lab-srv.dev/security/library/security-20260711-1e8734.md): AIOHTTP accepts duplicate Host headers
- [CVE-2026-34520: AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f48359.md): AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
- [CVE-2026-34519: AIOHTTP has HTTP response splitting via \r in reason phrase](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d9d1cc.md): AIOHTTP has HTTP response splitting via \r in reason phrase
- [CVE-2026-34518: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect](https://portal.chinng-lab-srv.dev/security/library/security-20260711-98fb3e.md): AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
- [CVE-2026-34517: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d6808c.md): AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
- [CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass](https://portal.chinng-lab-srv.dev/security/library/security-20260711-948d77.md): AIOHTTP has a Multipart Header Size Bypass
- [CVE-2026-34515: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows](https://portal.chinng-lab-srv.dev/security/library/security-20260711-e9b025.md): AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
- [CVE-2026-34514: AIOHTTP has CRLF injection through multipart part content type header construction](https://portal.chinng-lab-srv.dev/security/library/security-20260711-100e97.md): AIOHTTP has CRLF injection through multipart part content type header construction
- [CVE-2026-34513: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector](https://portal.chinng-lab-srv.dev/security/library/security-20260711-812ce3.md): AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
- [CVE-2026-34518 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-187376.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but re…
- [CVE-2026-34519 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-4bb846.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject e…
- [CVE-2026-34520 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-4bc02e.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in res…
- [CVE-2026-34525 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-1848ab.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
- [CVE-2026-34513 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-667ec2.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situ…
- [CVE-2026-34514 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-aee7ef.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra…
- [CVE-2026-34515 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-9ce7c4.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This…
- [CVE-2026-34516 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-0a3800.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory tha…
- [CVE-2026-34517 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-b423cc.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clie…
- [CVE-2026-22815 — aiohttp](https://portal.chinng-lab-srv.dev/security/library/security-20260714-e7b10d.md): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This i…
- [CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage](https://portal.chinng-lab-srv.dev/security/library/security-20260711-e0b270.md): aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
- [CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260705-6bd8a5.md): FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- [CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities](https://portal.chinng-lab-srv.dev/security/library/security-20260705-09bcef.md): FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
- [CVE-2025-64340: FastMCP has a Command Injection vulnerability - Gemini CLI](https://portal.chinng-lab-srv.dev/security/library/security-20260705-a2eedf.md): FastMCP has a Command Injection vulnerability - Gemini CLI
- [CVE-2026-25645 — requests](https://portal.chinng-lab-srv.dev/security/library/security-20260714-dbffd8.md): Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system t…
- [CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function](https://portal.chinng-lab-srv.dev/security/library/security-20260705-10b9a9.md): Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
- [CVE-2026-4539: Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching](https://portal.chinng-lab-srv.dev/security/library/security-20260711-f28f5b.md): Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
- [CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers](https://portal.chinng-lab-srv.dev/security/library/security-20260705-b8f0fa.md): FastMCP OAuth Proxy token reuse across MCP servers
- [CVE-2026-3783 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-fcd1cf.md): token leak with redirect and netrc
- [CVE-2026-3784 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-d9b286.md): wrong proxy connection reuse with credentials
- [CVE-2026-1965 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-f05b21.md): bad reuse of HTTP Negotiate connection
- [CVE-2026-1965: bad reuse of HTTP Negotiate connection](https://portal.chinng-lab-srv.dev/security/library/security-20260705-72944d.md): bad reuse of HTTP Negotiate connection
- [CVE-2026-3783: token leak with redirect and netrc](https://portal.chinng-lab-srv.dev/security/library/security-20260705-167342.md): token leak with redirect and netrc
- [CVE-2026-3784: wrong proxy connection reuse with credentials](https://portal.chinng-lab-srv.dev/security/library/security-20260705-a5946f.md): wrong proxy connection reuse with credentials
- [CVE-2026-1703: pip Path Traversal vulnerability](https://portal.chinng-lab-srv.dev/security/library/security-20260711-23941b.md): pip Path Traversal vulnerability
- [CVE-2026-24049: Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack](https://portal.chinng-lab-srv.dev/security/library/security-20260711-d5f723.md): Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
- [CVE-2025-71176: pytest has vulnerable tmpdir handling](https://portal.chinng-lab-srv.dev/security/library/security-20260711-19aa55.md): pytest has vulnerable tmpdir handling
- [CVE-2025-15079 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-0349d7.md): libssh global known_hosts override
- [CVE-2025-15224 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-0ad656.md): libssh key passphrase bypass without agent set
- [CVE-2025-14524 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-cb29e0.md): bearer token leak on cross-protocol redirect
- [CVE-2025-14819 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-9f8a2a.md): OpenSSL partial chain store policy bypass
- [CVE-2025-13034 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-16b450.md): No QUIC certificate pinning with GnuTLS
- [CVE-2025-14017 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-b9e9ac.md): broken TLS options for threaded LDAPS
- [CVE-2025-13034: No QUIC certificate pinning with GnuTLS](https://portal.chinng-lab-srv.dev/security/library/security-20260705-1ef7f7.md): No QUIC certificate pinning with GnuTLS
- [CVE-2025-14017: broken TLS options for threaded LDAPS](https://portal.chinng-lab-srv.dev/security/library/security-20260705-25786f.md): broken TLS options for threaded LDAPS
- [CVE-2025-14524: bearer token leak on cross-protocol redirect](https://portal.chinng-lab-srv.dev/security/library/security-20260705-f42473.md): bearer token leak on cross-protocol redirect
- [CVE-2025-14819: OpenSSL partial chain store policy bypass](https://portal.chinng-lab-srv.dev/security/library/security-20260705-1bfac5.md): OpenSSL partial chain store policy bypass
- [CVE-2025-15079: libssh global known_hosts override](https://portal.chinng-lab-srv.dev/security/library/security-20260705-72fe00.md): libssh global known_hosts override
- [CVE-2025-15224: libssh key passphrase bypass without agent set](https://portal.chinng-lab-srv.dev/security/library/security-20260705-514422.md): libssh key passphrase bypass without agent set
- [GHSA-rcfx-77hg-w2wv: FastMCP updated to MCP 1.23+ due to CVE-2025-66416](https://portal.chinng-lab-srv.dev/security/library/security-20260705-a527cd.md): FastMCP updated to MCP 1.23+ due to CVE-2025-66416
- [CVE-2025-10966 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-35fa1f.md): missing SFTP host verification with wolfSSH
- [CVE-2025-10966: missing SFTP host verification with wolfSSH](https://portal.chinng-lab-srv.dev/security/library/security-20260705-4d24d0.md): missing SFTP host verification with wolfSSH
- [CVE-2025-62801: FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name](https://portal.chinng-lab-srv.dev/security/library/security-20260705-5e93b4.md): FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
- [CVE-2025-62800: FastMCP vulnerable to reflected XSS in client's callback page](https://portal.chinng-lab-srv.dev/security/library/security-20260705-7c0b67.md): FastMCP vulnerable to reflected XSS in client's callback page
- [GHSA-c2jp-c369-7pvx: FastMCP Auth Integration Allows for Confused Deputy Account Takeover](https://portal.chinng-lab-srv.dev/security/library/security-20260705-bb8634.md): FastMCP Auth Integration Allows for Confused Deputy Account Takeover
- [CVE-2025-62727: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``](https://portal.chinng-lab-srv.dev/security/library/security-20260711-a27c94.md): Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
- [CVE-2025-8869: pip's fallback tar extraction doesn't check symbolic links point to extraction directory](https://portal.chinng-lab-srv.dev/security/library/security-20260711-41c2a0.md): pip's fallback tar extraction doesn't check symbolic links point to extraction directory
- [CVE-2025-54121: Starlette has possible denial-of-service vector when parsing large files in multipart forms](https://portal.chinng-lab-srv.dev/security/library/security-20260711-cd40e8.md): Starlette has possible denial-of-service vector when parsing large files in multipart forms
- [CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs](https://portal.chinng-lab-srv.dev/security/library/security-20260705-005fa6.md): Requests vulnerable to .netrc credentials leak via malicious URLs
- [CVE-2025-4947: QUIC certificate check skip with wolfSSL](https://portal.chinng-lab-srv.dev/security/library/security-20260705-e35883.md): QUIC certificate check skip with wolfSSL
- [CVE-2025-5025: No QUIC certificate pinning with wolfSSL](https://portal.chinng-lab-srv.dev/security/library/security-20260705-390cf1.md): No QUIC certificate pinning with wolfSSL
- [CVE-2025-4947 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-e49e3d.md): QUIC certificate check skip with wolfSSL
- [CVE-2025-5025 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-981b9e.md): No QUIC certificate pinning with wolfSSL
- [CVE-2025-3000: PyTorch is vulnerable to memory corruption through its torch.jit.script function](https://portal.chinng-lab-srv.dev/security/library/security-20260711-469b7d.md): PyTorch is vulnerable to memory corruption through its torch.jit.script function
- [CVE-2025-0167 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-90e95d.md): netrc and default credential leak
- [CVE-2025-0665 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-56a4b9.md): libcurl would wrongly close the same eventfd file descriptor twice when taking
- [CVE-2025-0725 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-6b2053.md): gzip integer overflow
- [CVE-2025-0167: netrc and default credential leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-129a10.md): netrc and default credential leak
- [CVE-2025-0725: gzip integer overflow](https://portal.chinng-lab-srv.dev/security/library/security-20260705-b79811.md): gzip integer overflow
- [CVE-2024-11053 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-af56d3.md): netrc and redirect credential leak
- [CVE-2024-11053: netrc and redirect credential leak](https://portal.chinng-lab-srv.dev/security/library/security-20260705-abfd66.md): netrc and redirect credential leak
- [CVE-2024-9681 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-20e477.md): HSTS subdomain overwrites parent cache entry
- [CVE-2024-9681: HSTS subdomain overwrites parent cache entry](https://portal.chinng-lab-srv.dev/security/library/security-20260705-3ced32.md): HSTS subdomain overwrites parent cache entry
- [CVE-2024-8096 — https://github.com/curl/curl](https://portal.chinng-lab-srv.dev/security/library/security-20260705-68e7a1.md): OCSP stapling bypass with GnuTLS
- [CVE-2024-8096: OCSP stapling bypass with GnuTLS](https://portal.chinng-lab-srv.dev/security/library/security-20260705-ce6cec.md): OCSP stapling bypass with GnuTLS
- [CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False](https://portal.chinng-lab-srv.dev/security/library/security-20260711-554627.md): Requests `Session` object does not verify requests after making first request with verify=False