BIT-LIBPYTHON-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

ALEAPP v2026.3.3

Android Logs Events And Protobuf Parser If you want to contribute hit me up here: https://abrignoni.github.io Blog posts here: https://leapps.org/blog Download Pre-built releases need no Python installation: ALEAPP GitHub Releases, or LEAPPs Releases for the whole LEAPP family. Platform| Download...

EUVD-2026-75781

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

Vim omni-completion Code Execution

The vulnerability of the Python omni-completion mechanisms for runtime/autoload/pythoncomplete.vim and runtime/autoload/python3complete.vim in the Vim text editor involves the integration of functionality from an unreliable source. Exploiting this vulnerability allows a remote attacker to execute...

Python omni-completion module autoload Code Execution

The vulnerability of the Python omni-completion module’s autoload mechanism, located in the runtime/autoload/python3complete.vim file, is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Fedora 45 : python-pip (2026-d083cbcc1a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d083cbcc1a advisory. Security fix for CVE-2026-13346 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Python vulnerabilities (USN-8744-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8744-1 advisory. It was discovered that Python's...

OPENSUSE-SU-2026:11755-1 python313-python-gnupg-0.5.6-2.1 on GA media

These are all security issues fixed in the python313-python-gnupg-0.5.6-2.1 package on the GA media of openSUSE Tumbleweed...

Fedora 45 : python-asteval (2026-79e569db98)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-79e569db98 advisory. Update to 1.0.10 Resolves: rhbz2413249 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Security update for python-jwcrypto (moderate)

openSUSE security update: security update for python-jwcrypto ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21827-1 Rating: moderate References: bsc1277639 bsc1278707 Cross-References: CVE-2026-80179 CVE-2026-84185 CVSS scores: CVE-2026-80179 SUSE...

Linux Distros Unpatched Vulnerability : CVE-2026-49836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path...

RockyLinux 9 : python-lxml (RLSA-2026:66204)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66204 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-88029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file...

CVE-2026-81211

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

DEBIAN-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

UBUNTU-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836 psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836 psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...