Poznaj podatności. Chroń swoje aplikacje.

Średnia 19.10.2026

ghsa-pcc4-rvhr-2pr8

Ekstraktor Fortran w Graphify: niekompletne zabezpieczenie cpp #include pozwala na odczyt/eksfiltrację dowolnych plików hosta przy indeksowaniu niezaufanego repozytorium

Niekompletne zabezpieczenie dyrektyw cpp #include w ekstraktorze Fortran w Graphify umożliwia odczyt i eksfiltrację dowolnych plików z hosta podczas indeksowania niezaufanego repozytorium.

Python (PyPI)

graphifyy

Średnia 30.09.2026

CVE-2026-103261

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Python (PyPI)

tornado

Wysoka 30.09.2026

CVE-2026-103262

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Python (PyPI)

tornado

Wysoka 30.09.2026

CVE-2026-103263

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Python (PyPI)

tornado

Wysoka 02.09.2026

CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Python (PyPI)

tornado

Średnia 01.09.2026

CVE-2026-91990

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Python (PyPI)

tornado

Niska 01.09.2026

CVE-2026-91991

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Python (PyPI)

tornado

Wysoka 31.07.2026

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Python (PyPI)

thumbor

Wysoka 23.06.2026

CVE-2026-55488

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

Python (PyPI)

motioneye

Wysoka 23.06.2026

CVE-2026-54134

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Python (PyPI)

octoprint

Średnia 22.06.2026

CVE-2026-31978

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

Python (PyPI)

motioneye

Wysoka 19.06.2026

CVE-2026-54528

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Python (PyPI)

jupyterlab-git

Wysoka 15.06.2026

CVE-2026-49855

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Python (PyPI)

tornado

Niska 12.06.2026

CVE-2026-49854

Tornado has out-of-bounds memory access via C extension

Python (PyPI)

tornado

Wysoka 15.06.2026

CVE-2026-49853

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Python (PyPI)

tornado

Średnia 10.06.2025

CVE-2025-48879

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

Python (PyPI)

octoprint

Wysoka 16.05.2025

CVE-2025-47287

Tornado vulnerable to excessive logging caused by malformed multipart form data

Python (PyPI)

tornado

Wysoka 22.11.2024

CVE-2024-52804

Tornado has an HTTP cookie parsing DoS vulnerability

Python (PyPI)

tornado

Wysoka 03.04.2024

CVE-2024-30265

Voilà Local file inclusion

Python (PyPI)

voila

Średnia 06.03.2024

CVE-2024-27287

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Python (PyPI)

esphome

Krytyczna 23.06.2026

ghsa-phv5-334h-mxcw

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

Python (PyPI)

motioneye

Średnia 15.06.2026

CVE-2026-91992

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Python (PyPI)

tornado

Krytyczna 03.06.2026

CVE-2026-44180

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

Python (PyPI)

jupyter-enterprise-gateway

Wysoka 11.03.2026

CVE-2026-35536

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Python (PyPI)

tornado