SmartPlanAI Anwendung

Certifi removes GLOBALTRUST root certificate

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

urllib3 does not control redirects in browsers and Node.js

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow has a heap buffer overflow with nested list coordinates

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

pytest has vulnerable tmpdir handling

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

protobuf affected by a JSON recursion depth bypass

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

protobuf-python has a potential Denial of Service issue

vite allows server.fs.deny bypass via backslash on Windows

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

Picomatch has a ReDoS vulnerability via extglob quantifiers

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

Tornado has out-of-bounds memory access via C extension

setuptools vulnerable to Command Injection via package URL

vite: `server.fs.deny` bypass on Windows alternate paths

Vite middleware may serve files starting with the same name with the public directory

tqdm CLI arguments injection attack

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

Jinja has a sandbox breakout through malicious filenames

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

Vite's `server.fs` settings were not applied to HTML files

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

Rollup 4 has Arbitrary File Write via Path Traversal

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse