OPENSUSE-SU-2026:21544-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE-SU-2026:23217-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE-SU-2026:23228-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...

SUSE CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

Security Bulletin: Vulnerability in marshmallow bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the marshmallow library, which is affected by a denial of service vulnerability. CVE-2025-68480. Vulnerability Details CVEID:CVE-2025-68480 DESCRIPTION: Marshmallow is a lightweight library for converting complex...

CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

react2shell-poc

React2Shell PoC CVE-2025-55182 Skrip Proof of Concept PoC...

PSF-2026-35

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

Malicious code in hex-encode-utils (npm)

Source: amazon-inspector 999c0a7bda643ce11c335436392aac35c2eca53dc92225dd86cbc01cc9015f8c On npm install, scripts/compat.js runs as a postinstall hook and fetches an AES-256-GCM-encrypted blob over HTTPS from two hardcoded Cloudflare Workers hosts steel-mere-4155.ricardorichp.workers.dev,...

Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

Security update for python-ujson

This update for python-ujson fixes the following issue: CVE-2026-44660: memory leak in ujson.dump on write failure can lead to DoS bsc1270301. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

SUSE-SU-2026:3539-1 Security update for python-ujson

This update for python-ujson fixes the following issue: - CVE-2026-44660: memory leak in ujson.dump on write failure can lead to DoS bsc1270301...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71870 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-71870 Source advisory: OSV:PYSEC-2026-3655...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71852 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-71852 Source advisory: OSV:PYSEC-2026-3656...

PYSEC-2026-3630 Keras: tar extraction permits symlink-based path traversal

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

CLSA-2026-1786357657 Fix CVE(s): CVE-2026-0864, CVE-2026-11972

SECURITY UPDATE: configuration file injection via carriage returns in written option values - debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write in Lib/ConfigParser.py, so that an...

RHSA-2026:52551 Red Hat Security Advisory: python-pillow security update

Bulletin has no description...

RHSA-2026:52400 Red Hat Security Advisory: python3 security update

Bulletin has no description...

Scrapling v0.4.13

Effortless Web Scraping for the Modern Web العربيه | Español | Português Brasil | Français | Deutsch | 简体中文 | 日本語 | Русский | 한국어 Selection methods · Fetchers · Spiders · Proxy Rotation · CLI · MCP Scrapling is an adaptive Web Scraping framework that handles everything f...

MAL-2026-13682 Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...