OESA-2026-4498 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

OESA-2026-4499 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

OESA-2026-4497 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

ROOT-APP-PYPI-CVE-2022-40897 CVE-2022-40897 in setuptools - Patched by Root

Root has patched CVE-2022-40897 in the setuptools package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-47273 CVE-2025-47273 in setuptools - Patched by Root

Root has patched CVE-2025-47273 in the setuptools package for Root:PyPI. Multiple fixed versions available...

CVE-2026-41940-Linux

CVE-2026-41940 — WHM/cPanel Exploit Tool Linux ⚠️ DISCLAIMER: This tool is intended for authorized penetration testing and educational purposes only. Using this tool against systems without explicit written permission is illegal. The developers are not responsible for any misuse or damage caused. ...

ROOT-APP-PYPI-CVE-2026-82397 CVE-2026-82397 in tornado - Patched by Root

Root has patched CVE-2026-82397 in the tornado package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-31958 CVE-2026-31958 in tornado - Patched by Root

Root has patched CVE-2026-31958 in the tornado package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1792659934 rsync: Fix of CVE-2026-53783

CVE-2026-53783: fix a TOCTOU escape from rrsync's restricted directory by replacing the lexical-only Perl support/rrsync with upstream's Python one, which pins each validated path component through /proc/self/fd, fails closed on path anomalies, pins the receiver option directories a peer can...

CLEANSTART-2026-GA47961 urllib3 is an HTTP client library for Python

CVE-2026-97688 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-FV21331 MessagePack is the serializer implementation for Python msgpack

CVE-2026-57585 affects multiple packages. MessagePack is the serializer implementation for Python msgpack. See references for individual vulnerability details...

CLEANSTART-2026-GI85240 urllib3 is an HTTP client library for Python

CVE-2026-97687 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-KW58831 urllib3 is an HTTP client library for Python

CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-YY80093 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the minio package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLSA-2026-1792629147 python-virtualenv: Fix of 3 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

CLSA-2026-1792629041 python-virtualenv: Fix of 4 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

Red Hat: CVE-2026-114613: msgpack: msgpack: Denial of Service via memory leak during map deserialization

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

Fedora 43 : python-cairosvg (2026-0a3e8cc0a0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0a3e8cc0a0 advisory. Update to 2.9.1 upstream release CVE-2026-107378 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:22136-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22136-1 advisory. Changes in python-joserfc: - CVE-2026-102946: JWS signature verification can be bypassed via empty signatures array bsc1285840 Tenable has extracted the...