Fedora 43 : GitPython / python-mkdocs-rss-plugin (2026-c4dfd51df1)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c4dfd51df1 advisory. Update to 3.2.0 Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94. Tenab...

CentOS Linux 7 [TuxCare] Security Update: python-setuptools (CENTOS7:CLSA-2026:1791500181)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1791500181 advisory. - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or...

Fedora 44 : GitPython / python-mkdocs-rss-plugin (2026-f2d13d09d7)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f2d13d09d7 advisory. Update to 3.2.0 Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94. Tenab...

PT-2026-117954

Name of the Vulnerable Software and Affected Versions Letta versions prior to 0.16.9 Description The default self-hosted setup includes a compose.yaml file that fails to enable LETTA SERVER SECURE, resulting in the omission of password middleware and leaving all API routes unauthenticated. This...

Linux Distros Unpatched Vulnerability : CVE-2026-112390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...

Linux Distros Unpatched Vulnerability : CVE-2026-112894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791825473)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791825473 advisory. - ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missin...

Linux Distros Unpatched Vulnerability : CVE-2026-112392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4738-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4738-1 advisory. This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic...

Debian dla-4843 : python-django-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4843 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-111750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. ...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

Ginlix AI LangAlpha security vulnerability

Ginlix AI LangAlpha versions 2026.09.07 and earlier contain a security vulnerability stemming from indirect prompt injection. Due to the absence of allowlists and manual approvals for Bash and ExecuteCode, attackers can insert commands into web pages retrieved by the proxy, thereby executing shel...

PT-2026-119530

Name of the Vulnerable Software and Affected Versions djust versions 0.9.0 through 1.0.9 djust versions 1.1.0 through 1.1.6 djust versions 1.2.0 through 1.2.3 djust versions 1.3.0rc1 through 1.3.0rc7 Description The find handlers for template MCP tool in python/djust/mcp/server.py accepts an...

PT-2026-117935

Name of the Vulnerable Software and Affected Versions LangAlpha versions prior to 2026.09.07 Description An indirect prompt injection allows remote attackers to execute shell commands or Python by placing instructions within web content retrieved by the agent. This occurs because the Bash and...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

PT-2026-119599

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

ALSA-2026:85930 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Alibaba Cloud Linux 3 : 0309: python-lxml (ALINUX3-SA-2026:0309)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0309 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-49825: lxml is a library for processing XM...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791825473)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791825473 advisory. - ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing...