Lucene search
+L

59663 matches found

OSV
OSV
added 2026/06/26 8:51 p.m.8 views

GHSA-5W7Q-77MV-V69F python-socketio: Binary attachment accumulation can cause denial of service

Impact The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its...

7.5CVSS5.8AI score
SaveExploits0References2
OSV
OSV
added 2026/06/26 8:51 p.m.5 views

GHSA-CGWC-PV48-FHJ5 python-engineio has unbound thread allocation that can cause denial of service

Impact An attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. Note: this issue primarily affects synchronous...

7.5CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 8:51 p.m.8 views

Allocation of Resources Without Limits or Throttling

Overview python-engineio is a Python implementation of the Engine.IO realtime client and server. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the heartbeat mechanism. An attacker can exhaust system resources by repeatedly triggering...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 8:48 p.m.7 views

Allocation of Resources Without Limits or Throttling

Overview python-engineio is a Python implementation of the Engine.IO realtime client and server. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of incoming messages when using ASGI with the long polling transport for POST...

8.7CVSS5.8AI score
SaveExploits0References2
OSV
OSV
added 2026/06/26 8:48 p.m.2 views

GHSA-M9GH-VJ53-GVH9 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

Impact There are two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases...

7.5CVSS5.8AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/26 8:35 p.m.14 views

Malicious code in pdf-converter-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b3a5f6d1d39c20feca11d0129f0efa21bdf564586045555b756cc25bce73efc Package is advertised as a PDF converter but contains no PDF generation code. Its sole public method TXTtoPDFConverter.createpdftxtpath, pdfpath is...

5.8AI score
SaveExploits0References2
NVD
NVD
added 2026/06/26 8:16 p.m.8 views

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.4CVSS0.00282EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/26 8:16 p.m.7 views

DEBIAN-CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.3CVSS5.9AI score0.00282EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/06/26 8:16 p.m.5 views

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.4CVSS6.2AI score0.00282EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/26 7:31 p.m.32 views

CVE-2026-29509

Patool before 4.0.5 is vulnerable to a path traversal in the safe_extract() function (patoolib/programs/py_tarfile.py). The is_within_directory() helper uses character-level comparison via os.path.commonprefix(), not path-level checks, allowing a crafted archive member path to bypass containment ...

5.4CVSS5.9AI score0.00282EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/26 7:31 p.m.31 views

CVE-2026-29509 Patool < 4.0.5 Path Traversal via safe_extract() Function

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.4CVSS0.00282EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/26 7:31 p.m.10 views

EUVD-2026-39879

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.4CVSS5.9AI score0.00282EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/26 7:31 p.m.4 views

CVE-2026-29509 Patool < 4.0.5 Path Traversal via safe_extract() Function

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.3CVSS6.1AI score0.00282EPSS
SaveExploits0References6
Debian CVE
Debian CVE
added 2026/06/26 7:31 p.m.6 views

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

5.4CVSS5.9AI score0.00282EPSS
SaveExploits0
OSV
OSV
added 2026/06/26 6:3 p.m.5 views

RLSA-2023:6712 Moderate: python-wheel security update

Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427. Security Fixes: python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli CVE-2022-40898 For more details about the security issues, including the impac...

7.5CVSS5.8AI score0.02659EPSS
SaveExploits1References2
Rockylinux
Rockylinux
added 2026/06/26 6:3 p.m.7 views

python-wheel security update

An update is available for python-wheel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Wheel is the reference implementation of the Python wheel packaging...

7.5CVSS6.9AI score0.02659EPSS
SaveExploits1
OSV
OSV
added 2026/06/26 6:0 p.m.6 views

RLSA-2023:2860 Moderate: python27:2.7 security update

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for...

7.5CVSS7.2AI score0.02453EPSS
SaveExploits1References2
Rockylinux
Rockylinux
added 2026/06/26 6:0 p.m.7 views

python27:2.7 security update

An update is available for python-backports-sslmatchhostname, python-ipaddress, python-markupsafe, module.python-chardet, module.python-pytest-mock, module.python-docs, python-pysocks, python-docutils, python-nose, module.python-markupsafe, module.python-dns, module.python-setuptoolsscm,...

7.5CVSS6.8AI score0.02453EPSS
SaveExploits1
OSV
OSV
added 2026/06/26 2:23 p.m.7 views

PYSEC-2026-235 Malicious code in ppkt2synergy (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of ppkt2synergy were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials an...

5.8AI score
SaveExploits0References3
OSV
OSV
added 2026/06/26 2:17 p.m.8 views

PYSEC-2026-234 Malicious code in phenopacket-store-toolkit (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of phenopacket-store-toolkit were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...

5.8AI score
SaveExploits0References3
Rows per page
Query Builder