72518 matches found
Unchecked Input for Loop Condition
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the FeatStructReader in nltk/featstruct.py. An attacker can trigger an unhandled RecursionError and cras...
CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration
opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...
CVE-2026-81096 ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...
EUVD-2026-67024
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...
Malicious Package
Overview discordnv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
CVE-2026-80205
A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability in the Text.findall and TokenSearcher.findall methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns tha...
CVE-2026-76098
A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by submitting specially crafted Markdown input. The excessive use of emphasis markers, such as consecutive asterisks, creates deeply nested tokens during HTML...
python: Fix of 3 CVEs
CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...
CVE-2026-81662
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.11: python3.11-3.11.16-1.1.hum1 aarch64, x8664 python3.11-debug-3.11.16-1.1.hum1 aarch64, x8664 python3.11-devel-3.11.16-1.1.hum1 aarch64, x8664 python3.11-idle-3.11.16-1.1.hum1 aarch64,...
python: Python base64: Incomplete data decoding due to premature stop at padding
A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode, the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial...
msf-commander
⚔️ MSF Commander v4.0 Complete Offensive Security Arsenal...
CVE-2026-71491
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the groupcomments function to repeatedly rescan these statements, leading to...
CVE-2026-54552
A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child...
web-xss-scanner-and-patcher
Web Vulnerability Assessment & Automated Python Scanner A han...
CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...
RHSA-2026:60371 Red Hat Security Advisory: python-urllib3 security update
Bulletin has no description...