62169 matches found
PT-2026-76633
openssl encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class . mro . subclasses to access system functions and execute arbitrary OS...
PT-2026-76749
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group parenthesis and group case, causing quadratic CPU consumption through sqlparse.parse,...
PT-2026-76781
Name of the Vulnerable Software and Affected Versions FreeCAD versions prior to 1.1.2 Description An issue exists in the PropertyPythonObject::Restore function within src/App/PropertyPythonObject.cpp where the software passes an attacker-controlled module attribute from serialized...
Important: python-urwid
Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...
PT-2026-76779
Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...
Important: python-urwid
Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...
CVE-2026-18503 vulnerabilities
Vulnerabilities for packages: python...
GHSA-2345-WR3R-CXF2 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-18503 vulnerabilities
Vulnerabilities for packages: python...
GHSA-2345-WR3R-CXF2 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-48804
A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. Thi...
ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root
Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...
RHSA-2026:54528 Red Hat Security Advisory: python-pillow security update
Bulletin has no description...
CVE-2026-73415 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 — Apache HTTP Server 2.4.49 Lab Reproduction o...
Malicious code in core-js-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3 The package's postinstall script package.json declares "postinstall": "node init.js" performs two hostile actions at install time. First, init.js POS...
CVE-2026-48809
A flaw was found in python-engineio. In specific configurations using ASGI with long polling or Aiohttp with WebSocket transport, the server does not properly validate the size of incoming messages before loading them into memory. A remote attacker can exploit this by sending oversized messages,...
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
EUVD-2026-58053
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...