SmartPlanAI Anwendung

Certifi removes GLOBALTRUST root certificate

nanoid: non-secure generators can loop indefinitely with negative size

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

nanoid: custom generators can loop indefinitely when size is zero

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

urllib3 does not control redirects in browsers and Node.js

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow has a heap buffer overflow with nested list coordinates

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

esbuild enables any website to send any requests to the development server and read the response

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

pytest has vulnerable tmpdir handling

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

protobuf affected by a JSON recursion depth bypass

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

protobuf-python has a potential Denial of Service issue

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

vite allows server.fs.deny bypass via backslash on Windows

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Requests vulnerable to .netrc credentials leak via malicious URLs

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Requests `Session` object does not verify requests after making first request with verify=False

Picomatch has a ReDoS vulnerability via extglob quantifiers

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop