Advisory Catalog

pypdf: Possible infinite loop in PdfWriter.find_outline_item

pypdf: Possible large memory usage when parsing content streams

pypdf: Possible large memory usage when parsing arrays and dictionaries

pypdf: Possible long runtimes/large memory usage when retrieving form fields

Pydantic AI Harness tool-call limit bypass in nested CodeMode calls

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

virtualenv: Deletion recovery can change a symlink target's mode

virtualenv: Generated files can follow existing destination links

virtualenv: Seeded files retain permissions from an older cache

virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv: Builtin creation follows linked environment directories

virtualenv: Temporary app-data can leave dangling seed package links

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow: Quadratic GIF comment copying during save

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

AIOHTTP: Pure-Python parser request smuggling

AIOHTTP: Absolute-form request targets can spoof Request.scheme

AIOHTTP: Connector pool exhaustion via Max-Age overflow

AIOHTTP: Secure attribute not enforced for shared cookie

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

unstructured: Stored XSS via unescaped HTML generation

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

copyparty FTP: upload outside defined volumes (limited path traversal)

Shiny for Python has path traversal in bookmark restore

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Banks: User-controlled prompt input can be parsed as privileged chat messages