CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-84305 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-84305 Source advisory: MEND:CVE-2026-84305...

CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

EUVD-2026-69421

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-84305

sqlparse , a non-validating SQL parser for Python, is vulnerable to quadratic CPU consumption in versions prior to 0.6.0. When processing attacker-controlled parenthesized tuple lists via sqlparse.format(sql, reindent=True) or sqlformat --reindent, the ReindentFilter._get_offset() function in sql...

LangAlpha v2026.09.01

The harness for agentic trading. Open-source AI agents that research the market, build the thesis, and trade your own brokerage account within the permissions you set. Try LangAlpha ↗ · Get started · Agentic trading · Harness design · Full-stack architecture · Security English · 简体中文 · 日本語 Why...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-69418

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

python-tuf v7.0.1

A Framework for Securing Software Update Systems The Update Framework TUF is a framework for secure content delivery and updates. It protects against various types of supply chain attacks and provides resilience to compromise. This repository is a reference implementation written in Python. It is...

Incorrect Authorization

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Incorrect Authorization in the loadcustomgenerate method of GenerativePreTrainedModel, where getcachedmodulefile in dynamicmoduleutils.py copies the...

CVE-2020-7494

creationtimestamp| type| source ---|---|--- 2026-09-01 17:01:12+00:00| seen| https://t.me/cissp/1528 2026-09-02 01:05:01+00:00| seen| https://t.me/cissp/1528 2026-09-12 01:00:05+00:00| published-proof-of-concept| https://t.me/cissp/1528 2026-09-13 00:01:01+00:00| published-proof-of-concept|...

GHSA-X9R9-C232-4Q39 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

intercept v2.33.0

Support the developer of this open-source project Signal Intelligence Platform A web-based interface for software-defined radio tools. Features Pager Decoding - POCSAG/FLEX via rtlfm + multimon-ng 433MHz Sensors - Weather stations, TPMS, IoT devices via rtl433 Sub-GHz Analyzer - RF capture and...

AZL-99351 CVE-2026-83616 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

AZL-99336 CVE-2026-83619 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

AZL-99339 CVE-2026-83610 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...