CVE-2026-33229

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-sentry-sdk: python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1 noarch python3-sentry-sdk+asyncpg-2.48.0-4.1.hum1 noarch python3-sentry-sdk+bottle-2.48.0-4.1.hum1 noarch...

Photon OS 4.0: Python3 PHSA-2026-4.0-0995

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0995. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OPENSUSE-SU-2026:10535-1 python311-cryptography-46.0.7-1.1 on GA media

These are all security issues fixed in the python311-cryptography-46.0.7-1.1 package on the GA media of openSUSE Tumbleweed...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-pip: python-pip-wheel-26.0.1-2.1.hum1 noarch python3-pip-26.0.1-2.1.hum1 noarch python-pip-26.0.1-2.1.hum1.src src...

SUSE CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers e.g. Hash.update, this could lead to buffer overflows. This vulnerability is fixed in...

adversarial-attacks-white-black-box (=0.1.7), datagenkit (=0.1.1) +37 more potentially affected by unknown CVE via rembg (>=2.0.57 <=2.0.69)

rembg PYPI version =2.0.57, =0.0.3, =1.0.0, =1.9.2, =5.1.6, =2.12.0, =1.0.0, =0.1.0, =1.0.3, =0.0.7, =2.0.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-REMBG-15990989...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libxml2: libxml2-16-2.15.2-0.3.hum1 aarch64, x8664 libxml2-2.15.2-0.3.hum1 aarch64, x8664 libxml2-devel-2.15.2-0.3.hum1 aarch64, x8664 libxml2-static-2.15.2-0.3.hum1 aarch64, x8664...

MAL-2026-2544 Malicious code in roboat-utilities (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 615237831a485ffde23ee69088df25f4ef45d00e99aab6fff27b7ee28f781890 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in robase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f128f86ab257491fc121f6b5d630cf37776085c139f199ec930ec16a31691855 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

1claw-crewai-tools (=0.1.0), aacp-crewai (=0.1.0) +1044 more potentially affected by unknown CVE via uv (>=0.10.0 <=0.11.4)

uv PYPI version =0.10.0, =1.10.30, =1.10.30, =0.31.5, =1.3.0, =1.6.0, =1.6.0, =1.2.2, =1.2.4, =0.6.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-UV-15969260...

PraisonAI has critical RCE via `type: job` workflow YAML

praisonai workflow run loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py. This supports: - run: → shell command execution via subprocess.run - script: → inline Python execution via exec - python: → arbitrary Python script execution A malicious YAML...

GHSA-VC46-VW85-3WVM PraisonAI has critical RCE via `type: job` workflow YAML

praisonai workflow run loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py. This supports: - run: → shell command execution via subprocess.run - script: → inline Python execution via exec - python: → arbitrary Python script execution A malicious YAML...

PraisonAI Vulnerable Untrusted Remote Template Code Execution

PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. --- Description When a user installs a template from a remote source e.g., GitHub,...

PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

PraisonAI's AST-based Python sandbox can be bypassed using type.getattribute trampoline, allowing arbitrary code execution when running untrusted agent code. Description The executecodedirect function in praisonaiagents/tools/pythontools.py uses AST filtering to block dangerous Python attributes...

cpython: Excessive read buffering DoS in http.client

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into...

python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation

A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...

cpython: Incomplete control character validation in http.cookies

A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update, |= operator, and unpickling paths were not patched to resolve CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output...

python: Python base64: Incomplete data decoding due to premature stop at padding

A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode, the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial...

cpython: CPython: Logging Bypass in Legacy .pyc File Handling

A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files .pyc, does not properly trigger system audit events. Th...