TencentOS Server 4: python-pip (TSSA-2026:1191)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1191 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: python-urllib3 (TSSA-2026:1192)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1192 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RockyLinux 9 : python3.9 (RLSA-2026:89742)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89742 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

AlmaLinux 8 : python-urllib3 (ALSA-2026:90759)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:90759 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block directly...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4904-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4904-1 advisory. This update for python, python-base, python-doc fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives...

Oracle Linux 8 : python-urllib3 (ELSA-2026-90759)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-90759 advisory. 1.24.2-11 - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser memory allocation in chunk parser Resolve...

Linux Distros Unpatched Vulnerability : CVE-2026-116578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture...

Linux Distros Unpatched Vulnerability : CVE-2026-115910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses...

MiracleLinux 9 : python3.9-3.9.25-7.el9_8.6 (AXSA:2026-2165:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2165:08 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verificatio...

homoglyphs

THE PROJECT IS ARCHIVED Forks: https://github.com/orsinium/forks Homoglyphs Homoglyphs -- python library for getting homoglyphs and converting to ASCII. Features It's smarter version of confusablehomoglyphs: Autodect or manual choosing category aliases from ISO 15924. Auto or manual load only...

CVE-2026-116589

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

Important: Red Hat Security Advisory: python-urllib3 security update

An update for python-urllib3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

WEASEL

WEASEL: A Stealthy DNS Beacon WEASEL is a small in-memory implant using Python 3 with no dependencies. The beacon client sends a small amount of identifying information about its host to a DNS zone you control. WEASEL server can task clients to execute pre-baked or arbitrary commands. WEASEL is a...

CVE-2026-116589

The Datadog dd-trace-py Python APM client (versions 3.13.0 through 4.15.5 ) contains a vulnerability in its IAST string-processing instrumentation . The root cause is the failure to properly handle internal errors during old-style % string formatting when processing attacker-controlled input. If ...

CVE-2026-116589 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116589 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116575

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, buildsessionscope in mem0/memory/main.py and Memory.buildSessionScope in the TypeScript SDK join caller-controlled userid, agentid, and runid values using unescaped ...

UBUNTU-CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...