CLSA-2026-1789365078 TuxCare security update for cryptography (2 CVEs)

TuxCare rebuilt cryptography to address 2 CVEs. Fixed in 44.0.3.post4+tuxcare...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

AndroidPhantom

👻 ANDROID PHANTOM 🏴‍☠️ The Next-Gen Android Pentesting Fr...

CVE-2026-90618

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.executecommand of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be...

CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

spade

Spade Automated web vulnerability scanner dengan 3 mode + mod...

PT-2026-91249

Name of the Vulnerable Software and Affected Versions a2aproject a2a-python versions prior to 1.1.4 Description A server-side request forgery issue exists in the Push Notification Sender component. The problem occurs within the dispatch notification function located in the src/a2a/server/tasks/ba...

python-tornado security update

6.5.8-0.1 - Update to 6.5.8 Resolves: RHEL-247281...

python-tornado security update

6.5.8-0.1 - Update to 6.5.8 Resolves: RHEL-247266...

Important: python-mistune

Issue Overview: Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in...

Oracle Linux 9 : ELSA-2026-67146-0: / python-tornado (ELSA-2026-671460)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-671460 advisory. 6.5.8-0.1 - Update to 6.5.8 Resolves: RHEL-247281 Tenable has extracted the preceding description block directly from the Oracle Linux security...

RHEL 9 : python-lxml (RHSA-2026:67324)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67324 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

PT-2026-91736

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An incomplete security scanner blocklist allows attackers to execute arbitrary Python code with root privileges UID=0 on the server by submitting components that import socket or urlli...

Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-55244: Uncaught Exception

ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROMPY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval, while run and eval in asteval/asteval.py catch Exception rather...

CVE-2026-12944: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

CVE-2026-90790: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

RHEL 10 : python-tornado (RHSA-2026:67147)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67147 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Oracle Linux 10 : ELSA-2026-67147-0: / python-tornado (ELSA-2026-671470)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-671470 advisory. 6.5.8-0.1 - Update to 6.5.8 Resolves: RHEL-247266 Tenable has extracted the preceding description block directly from the Oracle Linux security...

MiracleLinux 9 : python-lxml-4.6.5-3.el9_8.1 (AXSA:2026-1823:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1823:01 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...