Fedora 43 : python3-docs / python3.14 (2026-a3da6bb5cd)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3da6bb5cd advisory. New version of Python interpreter Security fix for CVE-2026-19553 Security fix for CVE-2026-82049 Security fix for CVE-2026-15310 Security fix for...

CVE-2026-110842 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member...

CVE-2026-110842 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member...

CVE-2026-110842

The n8n workflow automation tool (versions before 2.41.4 and 2.42.x before 2.42.1 ) is vulnerable to a prototype pollution vulnerability within the MCP workflow-validation tool . The root cause is that the tool's interpreter evaluates caller-supplied code in the main process, allowing for the rea...

CVE-2026-103929

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml settings from an untrusted local project before trust approval and striplocalonlysettings removes only fields marked globalonly. The unixdefaultfileshellargs,...

CVE-2026-103929 mise permits untrusted local configuration to override default shell arguments

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml settings from an untrusted local project before trust approval and striplocalonlysettings removes only fields marked globalonly. The unixdefaultfileshellargs,...

CVE-2026-103929

The mise tool (versions prior to 2026.7.14 ) contains a vulnerability where untrusted local configurations can override default shell arguments in default non-safe mode. Specifically, the application loads .mise.toml [settings] from untrusted projects without proper trust approval. Because certai...

MAL-2026-17880 Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden...

PT-2026-113959

Name of the Vulnerable Software and Affected Versions mise versions prior to 2026.7.14 Description In the default non-safe mode, the software loads settings from a .mise.toml file in an untrusted local project before trust approval. Because the strip local only settings function only removes fiel...

CVE-2026-103929: Improper Neutralization of Special Elements used in an OS Command

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml settings from an untrusted local project before trust approval and striplocalonlysettings removes only fields marked globalonly. The unixdefaultfileshellargs,...

Linux Distros Unpatched Vulnerability : CVE-2026-102734

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libpcap (UTSA-2026-130086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130086 advisory. In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BP...

DEBIAN-CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-102734

The asteval Python expression evaluator (prior to version 1.0.9 ) contains a sandbox escape vulnerability in asteval/astutils.py . When numpy is enabled, the default Interpreter exposes a ctypes type and allows memory access via from_address. While safe_getattr blocks the ctypes module, it fails ...

CVE-2026-102734 asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

Cisco NX-OS Python Sandbox Bypass Command Execution

The vulnerability of the built-in Python interpreter in the Cisco NX-OS operating system is related to insufficient spatial separation. Exploiting this vulnerability could allow an attacker to bypass the sandboxing protection mechanisms and execute arbitrary commands...

CVE-2026-102734: Protection Mechanism Failure

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

Command Injection

Overview agno is an Agno: a lightweight library for building Multi-Agent Systems Affected versions of this package are vulnerable to Command Injection via CodingTools.runshell in restricted mode, where an attacker can pass interpreter flags such as -c to allowlisted commands like python3 or pip t...