RLSA-2026:85239 Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

AZL-109890 CVE-2026-114094 affecting package python-dulwich 0.21.7-6

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

AZL-109893 CVE-2026-114095 affecting package python-dulwich 0.21.7-6

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

AZL-110082 CVE-2026-111943 affecting package python-tensorboard 2.16.2-6

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...

[slackware-security] python-certifi

New python-certifi packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/python-certifi-2026.10.19-i586-1slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the...

CVE-2026-114116 Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines, which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing...

CVE-2026-114116 Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines, which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing...

CVE-2026-114116

The Vyper compiler versions 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 are vulnerable to literal value manipulation. The root cause is the use of str.splitlines() to build the source-line table, which incorrectly treats characters like form feed and U+2028 as line breaks while the Python p...

CLEANSTART-2026-TX79542 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Security vulnerability affects the az package. python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

EUVD-2026-106322

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

Multiple vulnerabilities in Python affect AIX

IBM SECURITY ADVISORY First Issued: Wed Oct 21 00:15:44 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory22.asc Security Bulletin: Multiple vulnerabilities in Python affect AIX...

PT-2026-120795

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK V3 versions prior to 3.10.0 Amazon SageMaker Python SDK V2 versions prior to 2.257.3 Description Insufficient verification of the communication channel source within the default bucket function allows remote actors ...

Mercury Python Patch Kernel WebSocket Handler Code Execution

The vulnerability of the patchkernelwebsockethandler function in the Mercury Python framework is related to vulnerabilities in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

BLOCKED_PATTERNS Component Code Execution

The vulnerability of the BLOCKEDPATTERNS component in the Mercury Python framework is related to insufficient processing of regular expressions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-49264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in...

Python 3.11.3 URL Parsing Blocklist Bypass

Python version 3.11.3 and earlier affected branches contain a URL parsing discrepancy that can allow leading whitespace to bypass scheme and hostname blocklists. The supplied proof of concept shows urlparse and urlopen interpreting that input differently. https://packetstorm.news/download/236757...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142338 advisory. Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback...

SUSE SLES15 Security Update : python-hpack (SUSE-SU-2026:4593-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4593-1 advisory. This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation...