PT-2026-73547

TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post1+tuxcare...

PT-2026-73553

TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post1+tuxcare...

PT-2026-73717

TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post2+tuxcare...

PT-2026-73716

TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post2+tuxcare...

PT-2026-67718

Name of the Vulnerable Software and Affected Versions vibesurf-ai VibeSurf versions up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 Description A code injection flaw exists within the Python Validation Handler component, specifically affecting an unknown function in the /code file. This issue allo...

PT-2026-75231

TuxCare rebuilt python-multipart to address 2 CVEs. Fixed in 0.0.6.post5+tuxcare...

PT-2026-67859

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description Authenticated non-admin users with read-only access can obtain the full Python source code of server-side tools shared with them. This occurs because the response models permitted extra fields,...

PT-2026-67861

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's...

PT-2026-75194

TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post4+tuxcare...

PT-2026-67900

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

PT-2026-73653

TuxCare rebuilt mysql-connector-python to address 1 CVE. Fixed in 8.4.0.post1+tuxcare...

PT-2026-67721

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0 Description An issue exists in the PolarsVirtualServer backend where unauthenticated attackers can execute arbitrary operating system commands. This occurs because client-supplied input is passed directly to the Pytho...

PT-2026-75375

TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post6+tuxcare...

PT-2026-75061

TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post3+tuxcare...

PT-2026-67908

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

Important: python3-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

Important: python

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Linux Distros Unpatched Vulnerability : CVE-2026-47781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...

Linux Distros Unpatched Vulnerability : CVE-2026-47764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs...