CVE-2026-74899 openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses to access system functions and execute arbitrary OS comman...

EUVD-2026-60106

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

EUVD-2026-60093

opensslencrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generatepseudorandomsequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations...

ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root

Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-53537 CVE-2026-53537 in python-multipart - Patched by Root

Root has patched CVE-2026-53537 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-53539 CVE-2026-53539 in python-multipart - Patched by Root

Root has patched CVE-2026-53539 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-42561 CVE-2026-42561 in python-multipart - Patched by Root

Root has patched CVE-2026-42561 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59937 CVE-2026-59937 in pypdf - Patched by Root

Root has patched CVE-2026-59937 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root

Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...

BIT-PYTHON-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

BIT-PYTHON-MIN-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

BIT-PYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

BIT-LIBPYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

PT-2026-76720

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output format='python' and output format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate th...

PT-2026-76633

openssl encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class . mro . subclasses to access system functions and execute arbitrary OS...

PT-2026-76749

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group parenthesis and group case, causing quadratic CPU consumption through sqlparse.parse,...

PT-2026-76781

Name of the Vulnerable Software and Affected Versions FreeCAD versions prior to 1.1.2 Description An issue exists in the PropertyPythonObject::Restore function within src/App/PropertyPythonObject.cpp where the software passes an attacker-controlled module attribute from serialized...

PT-2026-76779

Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...