PT-2026-127745

Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlle...

XZ Utils 5.6.1 Backdoor Detection / Mitigation

An Ansible role and Python tool detect backdoored XZ Utils versions and liblzma libraries associated with CVE-2024-3094, back up affected files, upgrade supported distribution packages, and optionally restart sshd...

Linux Distros Unpatched Vulnerability : CVE-2026-115910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses...

Linux Distros Unpatched Vulnerability : CVE-2026-116578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture...

RockyLinux 9 : python3.9 (RLSA-2026:89742)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89742 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

PT-2026-127242

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, ast loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a...

MiracleLinux 9 : python3.9-3.9.25-7.el9_8.6 (AXSA:2026-2165:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2165:08 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verificatio...

TencentOS Server 4: python-urllib3 (TSSA-2026:1192)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1192 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

AlmaLinux 8 : python-urllib3 (ALSA-2026:90759)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:90759 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block directly...

python-urllib3 security update

1.24.2-11 - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser memory allocation in chunk parser Resolves: RHEL-282251...

ALSA-2026:90759 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Oracle Linux 9 : python-urllib3 (ELSA-2026-90494)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-90494 advisory. - CVE-2026-97687 python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282326 Tenable has extracted...

TencentOS Server 4: python-pip (TSSA-2026:1191)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1191 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4904-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4904-1 advisory. This update for python, python-base, python-doc fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives...

homoglyphs

THE PROJECT IS ARCHIVED Forks: https://github.com/orsinium/forks Homoglyphs Homoglyphs -- python library for getting homoglyphs and converting to ASCII. Features It's smarter version of confusablehomoglyphs: Autodect or manual choosing category aliases from ISO 15924. Auto or manual load only...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

CVE-2026-116589

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

Important: Red Hat Security Advisory: python-urllib3 security update

An update for python-urllib3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

WEASEL

WEASEL: A Stealthy DNS Beacon WEASEL is a small in-memory implant using Python 3 with no dependencies. The beacon client sends a small amount of identifying information about its host to a DNS zone you control. WEASEL server can task clients to execute pre-baked or arbitrary commands. WEASEL is a...