GHSA-M2H6-J472-RP4C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

CVE-2026-69248 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

GHSA-JWV3-5HGF-82WW vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, mlflow, az, openstack-nova-2025.1, openstack-nova-2026.1, vllm-openai-cuda-13.0, openstack-glance-2025.1, openstack-nova-2025.2, kserve, vllm-openai-cuda-12.9, openstack-glance-2025.2, apache-beam-python-3.13-sdk,...

MAL-2026-12113 Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12081 Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

CVE-2026-6879

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...

SUSE CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-8470: Use of a Broken or Risky Cryptographic Algorithm

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

PT-2026-68132

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description An operator-precedence bug exists in the cv.url validator within esphome/config validation.py. Due to the and operator binding tighter than or, any file: URI passes validation regardless of th...

Python cryptography Package DoS

The vulnerability of the buildchaininner function in the Python programming language’s cryptography library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Photon OS 5.0: Python3 PHSA-2024-5.0-91-0187

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Python3 PHSA-2026-5.0-91-0910

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0910. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Python3 PHSA-2023-5.0-91-0155

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0155. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Python3 PHSA-2026-5.0-91-0779

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0779. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-68157

Name of the Vulnerable Software and Affected Versions Fledge affected versions not specified Description The backup-restore upload handler upload backup located in python/fledge/services/core/api/backup restore.py is susceptible to OS command injection. The handler processes the first extracted t...

CVE-2026-17632: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning...

angr 9.3.2

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

CVE-2026-9196: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...