Security advisories

high2026-10-01

CVE-2026-102998-pypdf: Possible long runtimes when generating appearance streams

View chart →

py-pdf/pypdf · GHSA-php9-fj8v-98fj

high2026-10-01

CVE-2026-103000-pypdf: Possible large memory usage when retrieving alphabetical page labels

View chart →

py-pdf/pypdf · GHSA-w23x-9jrw-r45c

high2026-10-01

CVE-2026-102997-pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

View chart →

py-pdf/pypdf · GHSA-jw7q-gvrg-4vj3

high2026-10-01

CVE-2026-102996-pypdf: Possible large memory usage when parsing font data

View chart →

py-pdf/pypdf · GHSA-g9cg-prrw-2r8q

high2026-10-01

CVE-2026-102995-pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

View chart →

py-pdf/pypdf · GHSA-fp3h-c4fm-7vvf

high2026-10-01

CVE-2026-102994-pypdf: Possible long runtimes/large memory usage when parsing indirect objects

View chart →

py-pdf/pypdf · GHSA-5jq2-8x83-x246

high2026-10-01

CVE-2026-102993-pypdf: Possible large memory usage when retrieving Roman page labels

View chart →

py-pdf/pypdf · GHSA-qv6h-rv94-w285

critical2026-10-01

CVE-2026-102992-piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

View chart →

piscinajs/piscina · GHSA-67c8-pqhq-4rmx

high2026-10-01

CVE-2026-102990-basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

View chart →

patrickjuchli/basic-ftp · GHSA-c475-qrg2-pj4r

medium2026-10-01

CVE-2026-72788-SiYuan discloses an administrator's open documents and search terms to anonymous readers

View chart →

siyuan-note/siyuan · GHSA-hgfg-j9pg-43xw

critical2026-10-01

CVE-2026-69085-SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

View chart →

siyuan-note/siyuan · GHSA-33jq-p8c2-q3q4

high2026-09-30

CVE-2026-102930-virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

View chart →

pypa/virtualenv · GHSA-94p9-xgh2-xp45

medium2026-09-30

CVE-2026-102938-virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

View chart →

pypa/virtualenv · GHSA-9h9j-4vrj-gf7g

medium2026-09-30

CVE-2026-92081-fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

View chart →

fastify/fastify · GHSA-4mh8-r7rc-xpvc

medium2026-09-30

CVE-2026-103001-PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

View chart →

jpadilla/pyjwt · GHSA-gvp8-978c-rx2q

medium2026-09-30

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

View chart →

tornadoweb/tornado · GHSA-3hv7-mjh2-fv65

high2026-09-30

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

View chart →

tornadoweb/tornado · GHSA-chx6-46f5-w4vp

high2026-09-30

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

View chart →

tornadoweb/tornado · GHSA-c2m8-h5v5-343r

medium2026-09-30

GitPython submodule update path traversal can write outside the repository

View chart →

gitpython-developers/gitpython · GHSA-59cr-6r3x-644w

medium2026-09-30

CVE-2026-93981-hono/jsx renders plain strings unescaped in boundary components, leading to XSS

View chart →

honojs/hono · GHSA-hxh3-vqpv-xpqv