Amazon Linux 2 : python3, --advisory ALAS2-2026-3852 (ALAS-2026-3852)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3852 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser...

RHEL 8 : python3 (RHSA-2026:50064)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50064 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3847 (ALAS-2026-3847)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3847 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

SUSE SLED15 / SLES15 Security Update : python-urwid (SUSE-SU-2026:3460-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3460-1 advisory. This update for python-urwid fixes the following issue: - CVE-2026-9323: web session IDs generated by Screen.start are...

Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

RHEL 8 : python3 (RHSA-2026:50065)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50065 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Linux Distros Unpatched Vulnerability : CVE-2026-47781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...

Linux Distros Unpatched Vulnerability : CVE-2026-47764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

thrift: Apache Thrift Python bindings: Denial of Service via data amplification

A flaw was found in Apache Thrift Python bindings. This vulnerability involves the improper handling of highly compressed data, leading to a data amplification issue. An attacker could exploit this by providing specially crafted compressed input, which may cause the application to consume excessi...

thrift: Apache Thrift: Denial of Service via infinite loop

A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...

httpgrep v4.7

Description A fast, asynchronous Python tool that scans HTTPS servers and greps for strings or regex patterns in HTTP response bodies and headers. It takes single hosts, URLs, CIDR ranges, IP ranges or files; scans multiple ports per target single, comma-lists or ranges, auto-detecting TLS vs pla...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

AZL-94584 CVE-2026-69249 affecting package python-cryptography for versions less than 42.0.5-6

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

DEBIAN-CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

UBUNTU-CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...