CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

CVE-2026-12482

CVE-2026-12482 affects keras-team/keras v3.12.0. A path-traversal issue arises in tar extraction: symlink entries bypass the is_path_in_dir validation used for regular files in keras/src/utils/file_utils.py due to imperfect filter_safe_tarinfos. This allows crafting a malicious tar to place or re...

Security Bulletin: Multiple Vulnerabilities in IBM StreamSets SDK for Python

Summary Multiple vulnerabilities were addressed in IBM StreamSets SDK for Python 7.0.2 Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

SIP Sustainable Irrigation Platform 5.x (nr-url) Blind SSRF

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

Linux Distros Unpatched Vulnerability : CVE-2026-12482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in...

openSUSE 16 Security Update : python-cryptography (openSUSE-SU-2026:21294-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21294-1 advisory. This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow shor...

openSUSE 16 Security Update : python-pytest-html (openSUSE-SU-2026:21312-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21312-1 advisory. Changes in python-pytest-html: - Revendor updating brace-expansion: - force brace-expansion minimum version to fix CVE-2026-13149 bsc1269923 Tenable has...

openSUSE 16 Security Update : python-maturin (openSUSE-SU-2026:21285-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21285-1 advisory. This update for python-maturin fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short...

OPENSUSE-SU-2026:11271-1 python313-django-debug-toolbar-7.0.0-1.1 on GA media

These are all security issues fixed in the python313-django-debug-toolbar-7.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-58287

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4 Description The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A crafted payload containing an OID with many arcs can cause excessiv...

Oracle Linux 9 : vim (ELSA-2026-38511)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38511 advisory. - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3complete ...

ALSA-2026:39183 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 10 : python3.12 (RHSA-2026:39183)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39183 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

ALSA-2026:39127 Important: python-pillow security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:39320 Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python313-Pillow-12.3.0-1.1 on GA media (moderate)

python313-Pillow-12.3.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11261-1 Rating: moderate Cross-References: CVE-2014-3589 CVE-2014-3598 CVE-2016-0740 CVE-2016-0775 CVE-2016-3076 CVE-2020-15999 CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 CVE-2021-23437 CVE-2021-25289 CVE-2021-25290...

MAL-2026-10480 Malicious code in node-fsmetrics-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9958558a30dea32a3b0fc2e48bb775433e1f12b339030a8d21872ad058bc28ff On require, index.js hex-decodes the URL http://152.53.120.90/cmd and starts a background loop that polls /cmd/commands, executes returned strings vi...

PYSEC-2026-3435 python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

Impact AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query in self.deferredaddr and armed a per-addr timer in self.timersaddr that flushed the reassembled query within 500 ms RFC 6762 §18.5. Neither the per-addr list nor the number of distinct addr keys was capped, and...

CVE-2026-53538

A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker could exploit a vulnerability where the software incorrectly interprets certain characters as separators in web form data. This difference in interpretation compared to standard web practices allows ...