pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

▾ Sunlitpypa · pipEPSS 0.47%via NVD

CVE-2026-10177Medium· 6.3

4mo ago

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

▾ Sunlitaider-chat · aider-chatEPSS 0.21%via OSV

CVE-2026-10175Medium· 6.3

4mo ago

Aider is vulnerable to Code Injection via editor_coder.run function

▾ Sunlitaider-chat · aider-chatEPSS 0.24%via OSV

MAL-2026-5086None

4mo ago

Malicious code in polymarket-data (PyPI)

▾ Sunlitpolymarket-data · polymarket-datavia OSV

CVE-2026-42500None

4mo ago

Panic when reading out of bound palette index in golang.org/x/image/bmp

▾ Sunlitx · golang.org/x/imageEPSS 0.52%via OSV

GHSA-w5pp-99ch-qj29Medium· 6.5

4mo ago

go-git: Malformed Git object data may cause panics or resource exhaustion

▾ Sunlitgo-git · github.com/go-git/go-git/v5via OSV

Tagged “osv”

praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

GoClaw has a Command Injection issue

Apache Airflow has an Incorrect Authorization issue

Apache Airflow has a Missing Authorization issue

Apache Airflow has a Deserialization of Untrusted Data vulnerability

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key

hermes-agent has an Injection issue

Apache Airflow has an Improper Authorization issue

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Apache Airflow has a Link Following issue

Apache Airflow has no certificate validation on SMTP STARTTLS connections

Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow Vulnerable to Deserialization of Untrusted Data

Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args

AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass

Apache Airflow: Authenticated users can bypass the `is_safe_url` check

Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

Aider is vulnerable to Code Injection via editor_coder.run function

Malicious code in polymarket-data (PyPI)

Panic when reading out of bound palette index in golang.org/x/image/bmp

go-git: Malformed Git object data may cause panics or resource exhaustion