72471 matches found
CVE-2026-74860: Release of Invalid Pointer or Reference
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
CVE-2026-74860: Release of Invalid Pointer or Reference
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3300)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...
ALSA-2026:64795 Important: python3.14-cryptography security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Important: python3.14-cryptography security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
MGASA-2026-0380 Updated python-pyasn1 packages fix security vulnerabilities
The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a 1 ...
Updated python-pyasn1 packages fix security vulnerabilities
The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a 1 ...
ROOT-APP-PYPI-GHSA-3QJ8-93XH-PWH2 GHSA-3qj8-93xh-pwh2 in starlette - Patched by Root
Root has patched GHSA-3qj8-93xh-pwh2 in the starlette package for Root:PyPI. Multiple fixed versions available...
Malicious Package
Overview tsshare is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
python: Fix of CVE-2026-0864
CVE-2026-0864: fix configuration injection in the ConfigParser module by normalizing all line endings CR, CRLF and LF to LF+TAB when writing multi-line values, so a carriage return in an attacker-controlled value can no longer inject unexpected keys and values into the written file...
ROOT-OS-DEBIAN-12-CVE-2026-1502 CVE-2026-1502 in python3.11 - Patched by Root
Root has patched CVE-2026-1502 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-3276 CVE-2026-3276 in python3.11 - Patched by Root
Root has patched CVE-2026-3276 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-8328 CVE-2026-8328 in python3.11 - Patched by Root
Root has patched CVE-2026-8328 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
SUSE-SU-2026:23523-1 Security update for python-tornado6
This update for python-tornado6 fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725...
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...
SUSE-SU-2026:4031-1 Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...
qiling v1.4.11
Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...
CVE-2026-86237
A server-side request forgery (SSRF) vulnerability affects the openagents-org/openagents Python SDK in versions up to 0.8.19 / 0.9.3.post20 . The vulnerable function is test_default_model in sdk/src/openagents/sdk/transports/http.py, where an unvalidated base_url argument allows a remote, unauthe...
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependen...
