GitPython Code Execution

The vulnerability of the checkunsafeoptions mechanism in the Python library for interacting with Git repositories, GitPython, is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to rewrite any files in the system remote...

UBUNTU-CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

Use of Hard-coded Credentials

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Unchecked Return Value

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the process method of sqlparse/filters/output.py when generating output via the Python and PHP output formatters. The formatters previously only escaped quote characters ' or " but did not first escape...

PYSEC-2026-3727

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses to access system functions and execute arbitrary OS comman...

PYSEC-2026-3771

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use class, bases, subclasses, and globals chains to access restricted functions and execute arbitrary...

PYSEC-2026-3770

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

PYSEC-2026-3764

opensslencrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords...

speakeasy v2.0.0b6

Speakeasy Speakeasy is a Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled Windows runtime instead of a full VM. It emulates APIs, process/thread behavior, filesystem, registry, and network activity so samples can keep moving through realistic executi...

UBUNTU-CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

UBUNTU-CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

CLSA-2026-1786470220 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post8+tuxcare...

[SECURITY] Fedora 43 Update: python-wsgidav-4.3.5-1.fc43

A generic and extendable WebDAV server written in Python and based on WSGI. Main features: =E2=80=A2 WsgiDAV is a stand-alone WebDAV server with SSL support, that can be installed and run as Python command line script. =E2=80=A2 The python-pam library is needed as extra requirement if pam-login...

Quadratic Behavior in xml.etree.ElementPath Index Predicates

...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

CLSA-2026-1780274962 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post9+tuxcare...

PYSEC-2026-3551 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...