urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of co…

▾ Twilightpython · urllib3EPSS 0.68%via NVD

CVE-2025-66471High· 7.5

9mo ago

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large H…

Tagged “osv”

Pyrofork has a Path Traversal in download_media Method

HTTP/HTTPS Traffic Interception Bypass in mad-proxy

NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read

Open Redirect Vulnerability in Taguette

Traefik Inverted TLS Verification Logic in ingress-nginx Provider

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

Sigstore Timestamp Authority allocates excessive memory during request parsing

Malicious code in rendom (PyPI)

urllib3 is a user-friendly HTTP client library for Python

urllib3 is a user-friendly HTTP client library for Python

Logrus is vulnerable to DoS when using Entry.Writer()

open-webui is Vulnerable to Incorrect Access Control

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Ansible Community General Collection is vulnerable to exposure of sensitive information

ComposioHQ has a directory traversal vulnerability

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

Django is vulnerable to DoS via XML serializer text extraction

Django is vulnerable to SQL injection in column aliases

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

asyncmy is vulnerable to SQL injection via crafted dict keys

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Keras Directory Traversal Vulnerability

Werkzeug safe_join() allows Windows special device names

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Spotipy has a XSS vulnerability in its OAuth callback server

vllm: vLLM: Remote Code Execution via malicious model configuration (CVE-2025-66448)

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib