EUVD-2026-53369

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting: cmd = "cp ".formatsource, backuppath; retcode = os.systemcmd. The only pre-check o...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

claudit

claudit – AI-based code security auditing tool claudit is an...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

RHSA-2026:50065 Red Hat Security Advisory: python3 security update

Bulletin has no description...

RHSA-2026:50064 Red Hat Security Advisory: python3 security update

Bulletin has no description...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

CVE-2026-69249 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

GHSA-M2H6-J472-RP4C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

CVE-2026-69248 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

GHSA-JWV3-5HGF-82WW vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

MAL-2026-12113 Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12081 Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

CVE-2026-6879

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...