Python
8 articles
Langflow CVE-2026-93680 and 32 more bugs. Strangers can get into 1.12.x servers, so upgrade to 1.13.0
How to fix CVE-2026-93680: upgrade Langflow to 1.13.0. IBM published 33 Langflow CVEs on Oct 29, 2026. Two 9.8s through 1.12.8 need no login, Metasploit already has a module for the auth bypass, and the upgrade can lock you out unless you set a superuser password first.
HOL GuardA LiteLLM Enterprise proxy will leak its master key to a request with no API key. Upgrade to 1.106.5 (GHSA-w4c7-34wj-hqm8)
How to fix GHSA-w4c7-34wj-hqm8: upgrade litellm to 1.106.5, 1.105.6, 1.104.8 or 1.103.10, restart, then rotate LITELLM_MASTER_KEY. An unauthenticated request could make an Enterprise-licensed LiteLLM proxy read its own process environment and send it to an attacker host. CVSS 10.0.
HOL GuardeMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
HOL GuardLiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keys
How to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
HOL GuardCVE-2026-76832: Agno PythonTools Path Traversal Escapes base_dir
How to fix CVE-2026-76832: upgrade agno to 2.3.24 or later (current PyPI 2.9.0). PythonTools path traversal can read, write, or run files outside base_dir.
HOL GuardCVE-2026-76850 - LMDeploy Pickle RCE in Disaggregated Serving
How to fix CVE-2026-76850: upgrade InternLM lmdeploy to 0.16.0. Unauthenticated pickle RCE in disaggregated serving. Affects >=0.9.2 and <0.16.0.
HOL GuardCVE-2026-74764 - Pandora TAR Path Traversal Enables Arbitrary File Write
CVE-2026-74764 is a CVSS 10.0 path traversal in Pandora TAR extraction that lets untrusted archives write outside the analysis directory. v1.12.5 is affected; deploy the upstream fix.
HOL GuardCVE-2026-9318: tablib Stored XSS via HTML Export Dataset Title
tablib, a Python tabular data library with over 147 million PyPI downloads, contains a stored cross-site scripting vulnerability in its HTML export functionality. Attackers can embed JavaScript payloads in dataset titles that execute when the exported HTML file is opened in a browser. Fixed in version 3.10.0.
Michael KantorRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.