https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T19:04:20.115289+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337172 EUVD-2026-337172 2026-10-16T19:04:20.117930+00:00 EUVD-2026-337172 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6587 fkie_cve-2026-6587 2026-10-16T19:04:20.117961+00:00

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

 https://cve.radiocsirt.org/vuln/ghsa-95ww-475f-pr4f GHSA-95ww-475f-pr4f — RAGAS has SSRF via Multi-Modal Faithfulness Collections Module 2026-10-16T19:04:20.117993+00:00

Affected: PyPI: ragas

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

 https://cve.radiocsirt.org/vuln/pysec-2026-3046 PYSEC-2026-3046 — RAGAS has SSRF via Multi-Modal Faithfulness Collections Module 2026-10-16T19:04:20.118018+00:00

Affected: PyPI: ragas

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.