59369 matches found
PYSEC-2026-3039 python-multipart has Denial of Service via unbounded multipart part headers
Summary python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many...
PYSEC-2026-2876 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-53538
A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker could exploit a vulnerability where the software incorrectly interprets certain characters as separators in web form data. This difference in interpretation compared to standard web practices allows ...
SUSE-SU-2026:2875-1 Security update for python-Pillow
This update for python-Pillow fixes the following issues - CVE-2026-54059: crafted PCF font data can cause excessive memory allocation bsc1270409. - CVE-2026-54060: a font can trigger excessive allocation during conversion or saving bsc1270410. - CVE-2026-55379: bypass of decompression bomb...
Malicious code in turbocalcng (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448 turbocalcng/init.py imports arithmetic.py, which — beneath a facade of arithmetic helpers — contains an XOR-obfuscated in-memory native code executio...
CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization
A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is abl...
CVE-2026-15519
A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...
CVE-2026-15519 usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere
A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...
EUVD-2026-43262
A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...
CVE-2026-15519
The CVE-2026-15519 entry affects usestrix strix up to 1.0.2, specifically the PyPI Handler’s file system_prompt.jinja. A manipulation can cause inclusion of functionality from an untrusted control sphere. The vulnerability is exploitable remotely with network impact and a high attack complexity; ...
ROS-20260713-73-0034
The vulnerability in Python-Relenv relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
ROS-20260713-73-0026
The vulnerability of the tarfile module in the Python programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
ROS-20260713-73-0024
The vulnerability of the FileLoader class in the CPython interpreter relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
ROS-20260713-73-0035
The vulnerability in Python-Relenv relates to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...
Malicious code in data-harvester (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c2e2c21d9afac9277d95589962d33a09651a5b6ef7e0b3c9e07aee56af213f On first import, dataharvester/init.py decodes a base64-embedded 486KB Linux ELF, writes it to /.config/.npm-cache/snapd-network, sets mode 0777, and...
[SECURITY] Fedora 44 Update: python-dulwich-1.2.9-1.fc44
Dulwich is a Python implementation of the Git file formats and protocols. The project is named after the village in which Mr. and Mrs. Git live in the Monty Python sketch...
[SECURITY] Fedora 44 Update: python-tornado-6.5.7-1.fc44
Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks and certainly most Python frameworks because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle...
[SECURITY] Fedora 43 Update: python-tornado-6.5.7-1.fc43
Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks and certainly most Python frameworks because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle...
