HIGH7.5PyPI
GHSA-5rmq-chc7-m22f· CVE-2026-114106Vibe-Trading file-read tools expose arbitrary server-readable files
Modified: 10/21/2026
package
PyPI/vibe-trading-ai
pkg:pypi/vibe-trading-ai
CRITICAL10.0PyPI
GHSA-jqmf-mx4f-hfr6· CVE-2026-114107Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Modified: 10/21/2026
CRITICAL10.0PyPI
GHSA-v2f8-6655-7grj· CVE-2026-114108Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Modified: 10/21/2026