59162 matches found
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...
PYSEC-2026-2050 Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
Impact The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to t...
PYSEC-2026-2075 Information disclosure in AccessControl
Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...
Pyramid static view path traversal up one directory
ImpactThis impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...
PYSEC-2026-1840 Pyramid static view path traversal up one directory
Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...
Any file can be included with the pymdown-snippets extension
SummaryArbitrary file read when using include file syntax. DetailsBy using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to...
Important: Red Hat Security Advisory: python3.14-pip security update
An update for python3.14-pip is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
PYSEC-2026-917 Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions
Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.1...
PYSEC-2026-915 Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions
Impact Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. Affected versions: Saleor ≥ 2.0.0 Workarounds None For more information If you...
PYSEC-2026-769 Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...
PYSEC-2026-1021 `CHECK` fail via inputs in `PyFunc`
Impact An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. python import tensorflow as tf value = tf.constantvalue=1,2 token = b'\xb0' dataType = tf.int32 tf.rawops.PyFuncinput=value,token=token,Tout=dataType Patches We have patched the issue in GitHub...
PYSEC-2026-922 snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)
An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the getfiletransfertype method...
PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...
PYSEC-2026-899 protobuf-cpp and protobuf-python have potential Denial of Service issue
Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory OOM failure when processing a specially crafted message, which could lead to a denial of service DoS on services using the libraries. Reporter: ClusterFuzz...
ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root
Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48809 CVE-2026-48809 in rootio-python-engineio - Patched by Root
Root has patched CVE-2026-48809 in the rootio-python-engineio package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48802 CVE-2026-48802 in rootio-python-engineio - Patched by Root
Root has patched CVE-2026-48802 in the rootio-python-engineio package for Root:PyPI. Multiple fixed versions available...
OPENSUSE-SU-2026:11203-1 python313-httplib2-0.32.0-1.1 on GA media
These are all security issues fixed in the python313-httplib2-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed...
ALSA-2026:36193 Important: python3.14-pip security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
