60574 matches found
The vulnerability of the Python programming language’s HTTP client module allows attackers to inject arbitrary HTTP headers.
The vulnerability of the Python programming language’s HTTP client module is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-2620)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when...
EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2563)
According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...
EulerOS 2.0 SP12 : python-jwt (EulerOS-SA-2026-2617)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2819-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2819-1 advisory. This update for python-Django fixes the following issues - CVE-2026-48588: potential exposure of private data via cached Set-Cookie response...
EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-2624)
According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...
openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:21263-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21263-1 advisory. Changes in python-joserfc: - CVE-2026-49852: HS256/HS384/HS512 verify accepts empty/nil HMAC key bsc1270234 Tenable has extracted the preceding...
EUVD-2026-39007
Mistune: Potential DoS via quadratic-time parsing in parselinktext...
CVE-2026-54769 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution RCE in its TableChatAgent and VectorStore capabilities. When these agents evaluate LLM-generated tool messages with...
CVE-2026-54769
Langroid versions prior to 0.65.2 are affected by a critical Sandbox Escape leading to Remote Code Execution via incomplete mitigation in the TableChatAgent and VectorStore. The root cause is the use of eval() with an empty locals dict under full_eval=True, where builtins is not scrubbed from glo...
MAL-2026-10100 Malicious code in proxy-check-i (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator...
CVE-2026-55865
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...
CVE-2026-55865
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...
CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...
CVE-2026-55865
CVE-2026-55865 concerns the Python Liquid template engine. Before version 2.2.1, a malformed {% case %} tag without a corresponding {% when %} or {% else %} and without a terminating {% endcase %} could cause an infinite loop during parsing, due to an incorrect EOF token handling in liquid.TokenS...
CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...
CVE-2026-15308
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...
Security update for python-idna
This update for python-idna fixes the following issue CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:2828-1 Security update for python-idna
This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413...