CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101917

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a denial-of-service vector due to how it handles unknown keys in the get_signing_key_from_jwt function. Because the library lacks a negative cache or minimum refresh interval, repeated requests using unknown or varying kid value...

EUVD-2026-88478

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-101861

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious repr method into component input options lists. The eval sink is triggered when a...

ROOT-APP-PYPI-CVE-2024-5569 CVE-2024-5569 in zipp - Patched by Root

Root has patched CVE-2024-5569 in the zipp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-101861 Langflow Code Execution via eval() in Component Input Schema

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious repr method into component input options lists. The eval sink is triggered when a...

SUSE-SU-2026:4365-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. - CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a...

Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS...

Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

ROOT-APP-PYPI-CVE-2026-24049 CVE-2026-24049 in setuptools - Patched by Root

Root has patched CVE-2026-24049 in the setuptools package for Root:PyPI. Multiple fixed versions available...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in Apache Thrift (CVE-2026-41608, CVE-2026-66053)

Summary Multiple Denial of Service vulnerabilities in Apache Thrift CVE-2026-41608, CVE-2026-66053 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.24.0. Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540)

Summary Multiple Denial of Service and resource exhaustion vulnerabilities in the python-multipart parser library CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32...

CVE-2026-84655

A flaw was found in Jenkins. When serializing objects as JSON and Python through its REST API, Jenkins does not properly escape map keys. This allows an attacker who can control map property names to inject arbitrary fields into JSON and Python API responses, potentially leading to information...

proofcms

ProofCMS ProofCMS is a modular Python toolkit for detecting c...

PT-2026-108328

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is pem format in jwt/utils.py is affected because is pem format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...