CVE-2026-78379: Undefined Security Weakness

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

claude-bug-bounty

BugHunter صيد مكافآت الاختراق مدعوم بالذكاء الاصطناعي — من الاستطلاع إلى التقرير، داخل جهازك الطرفي. إعداد مجاني · بدء سريع · الأوامر · ما يجده · التثبيت · الأسئلة الشائعة !BUGHUNTER — خط أنابيب أتمتة مكافآت...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in Python [CVE-2026-57585]

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS vulnerability in Python, due to an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack CVE-2026-57585. Python is used in our service runtimes. This vulnerability has been addressed...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

DEBIAN-CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

DEBIAN-CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

UBUNTU-CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

EUVD-2026-65138

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS bsc1275461...

SUSE-SU-2026:3762-1 Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: - CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. - CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS bsc1275461. -...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...