Agent

Certifi removes GLOBALTRUST root certificate

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

virtualenv: Xonsh activation literals depend on the script decoding codec

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

virtualenv: Deletion recovery can change a symlink target's mode

dnspython dns.name.from_wire_parser() excessive CPU use

urllib3 does not control redirects in browsers and Node.js

virtualenv: Downloaded wheel selection and caching precede verification

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

virtualenv: Generated files can follow existing destination links

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

AnyIO process-pool workers can block indefinitely on undrained stderr

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

certifi bundles emSign root CAs with compromised intermediate CA keys

Authlib: empty signatures validation in JWS JSON deserialization

virtualenv: Bash prompt values can change meaning under older compatibility modes

pytest has vulnerable tmpdir handling

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

PyJWT accepts unknown `crit` header extensions

Vulnerable OpenSSL included in cryptography wheels

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Werkzeug safe_join() allows Windows special device names with compound extensions

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

virtualenv activation scripts run code from a path that contains a placeholder name

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes