PT-2026-70832

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

Python Lib/html/parser Heap Buffer Overflow DoS

The vulnerability of the Lib/html/parser.py component of the Python interpreter is related to the insufficient use of the assert function. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, as well as cause service failures through the creation of...

Python interpreter Path Traversal

The vulnerability of the Python programming language interpreter is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability can allow attackers to compromise data integrity...

PT-2026-70939

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allow python templates=False, allowing a nested python:...

PraisonAI CodeAgent 1.6.77 Remote Code Execution

The CodeAgent.executepython in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection. Versions 1.6.77 and below are affected. !/usr/bin/env python3 Exploi...

Fedora 43 : mingw-python-pip (2026-f7dddb6162)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f7dddb6162 advisory. Update to pip-26.2. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for thi...

Python-cryptography Elliptic Curve Private Key Disclosure

The vulnerabilities of the functions EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey in the Python-cryptography cryptographic library are related to insufficient validation of data authenticity. Exploiting these vulnerabilities...

Langflow Remote Code Execution

Langflow versions prior to 1.9.0 are susceptible to unauthenticated remote code execution through the /api/v1/buildpublictmp/flowid/flow endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. frozenstringliteral: true This module requires...

SUSE SLED15 / SLES15 Security Update : python-ujson (SUSE-SU-2026:3539-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3539-1 advisory. This update for python-ujson fixes the following issue: - CVE-2026-44660: memory leak in ujson.dump on write failure ca...

CVE-2026-73233: Improper Control of Generation of Code

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is required to exploit this vulnerability. The specific flaw exists within the run method of the CSVAgents class. The issue results from the lack of proper validation of a...

Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run method of the AirtableAgents class. The issue results from the lack of proper validation...

GHSA-H7PC-VWP9-298G vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1...

CVE-2026-8404 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1...

OPENSUSE-SU-2026:21544-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE-SU-2026:23217-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE-SU-2026:23228-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

Security Bulletin: Vulnerability in marshmallow bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the marshmallow library, which is affected by a denial of service vulnerability. CVE-2025-68480. Vulnerability Details CVEID:CVE-2025-68480 DESCRIPTION: Marshmallow is a lightweight library for converting complex...

CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...