GitHub Advisories (PyPI)
Printed in Security Desk · github.com
Publishes about 4 a week · last piece Oct 16, 2026
How often
about 4 a week, by the archive: 18 pieces since Sep 18, 2026.
12 weeks agothis week
Latest pieces
- Critical: LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- Critical: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
- Critical: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
- Critical: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
- Critical: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
- Critical: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
- Critical: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
- Critical: Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
- Critical: Langflow: Weak Fernet Key via random.seed()
- Critical: Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
- Critical: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
- Critical: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- Critical: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
- Critical: plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
- Critical: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
In these topics
Pick one in My Edition to read it with its neighbors.