JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_…

▾ Twilightjupyter · jupyterlabEPSS 0.85%via NVD

CVE-2026-44432High· 7.5

4mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed…

▾ Twilightpython · urllib3EPSS 0.88%via NVD

CVE-2026-44431Medium· 5.3PoC

4mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive hea…

▾ TwilightRed Hat · Red Hat Enterprise Linux AppStream (v. 8)EPSS 0.34%via NVD

Tagged “pip”

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

Mistune Image Directive CSS Injection Vulnerability

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

Open WebUI has Stored Cross-Site Scripting In Profile Picture

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Mistune TOC Anchor Injection XSS

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint

Open WebUI has stored XSS via the HTML renedering view

Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

Open WebUI's chat completion API allows tool restrictions to be bypassed

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot: GitRepository.current_head field should not be writable through REST API

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python