72753 matches found
PT-2026-75231
TuxCare rebuilt python-multipart to address 2 CVEs. Fixed in 0.0.6.post5+tuxcare...
CVE-2026-70470: Incomplete List of Disallowed Inputs
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...
PT-2026-67908
Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...
PT-2026-67861
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's...
PT-2026-67900
Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...
PT-2026-73717
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post2+tuxcare...
OPENSUSE-SU-2026:11451-1 python311-pip-26.2-1.1 on GA media
These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed...
Important: python3-tornado
Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...
CVE-2026-18770: Improper Control of Generation of Code
A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This produc...
PT-2026-67718
Name of the Vulnerable Software and Affected Versions vibesurf-ai VibeSurf versions up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 Description A code injection flaw exists within the Python Validation Handler component, specifically affecting an unknown function in the /code file. This issue allo...
PT-2026-67721
Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0 Description An issue exists in the PolarsVirtualServer backend where unauthenticated attackers can execute arbitrary operating system commands. This occurs because client-supplied input is passed directly to the Pytho...
Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3847 (ALAS-2026-3847)
The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3847 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...
RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)
The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...
Linux Distros Unpatched Vulnerability : CVE-2026-47764
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs...
Linux Distros Unpatched Vulnerability : CVE-2026-47781
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...
SUSE SLED15 / SLES15 Security Update : python-urwid (SUSE-SU-2026:3460-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3460-1 advisory. This update for python-urwid fixes the following issue: - CVE-2026-9323: web session IDs generated by Screen.start are...
PT-2026-73553
TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post1+tuxcare...
PT-2026-67859
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description Authenticated non-admin users with read-only access can obtain the full Python source code of server-side tools shared with them. This occurs because the response models permitted extra fields,...