gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

RHSA-2026:41949 Red Hat Security Advisory: python3.14 security update

Bulletin has no description...

OPENSUSE-SU-2026:21430-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22937-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22863-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: policycoreutils: policycoreutils-3.11-2.1.hum1 aarch64, x8664 policycoreutils-dbus-3.11-2.1.hum1 noarch policycoreutils-devel-3.11-2.1.hum1 aarch64, x8664 policycoreutils-gui-3.11-2.1.hum1 noarch...

PT-2026-63982

Name of the Vulnerable Software and Affected Versions JetBrains PyCharm versions prior to 2026.1.4 JetBrains PyCharm version 2026.2 Description Opening an untrusted project can lead to arbitrary code execution through the use of a malicious Python executable. Recommendations Update to version...

Oracle Linux 9 : python3.14 (ELSA-2026-41949)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41949 advisory. 3.14.5-1.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193779 Tenable has extracted the preceding description block directly from the Oracle Linux securit...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3179-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3179-1 advisory. This update for python-sqlparse fixes the following issue - Fixed a bug where formatting list of tuples leads to denial of service bsc126859...

Fedora 44 : python-black / python-lsp-black / python-pytokens (2026-3805ba3721)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3805ba3721 advisory. Upgrade to 26.5.1, solves serious vulnerabilities such as: CVE-2026-31900 CVE-2026-32274 Tenable has extracted the preceding description block...

PT-2026-64164

Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions prior to 1.18.1 Description Improper neutralization of argument delimiters in the install packages method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter...

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

GHSA-89VP-JRXV-24W8 JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

EUVD-2026-42350

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks...

CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

CVE-2026-59886 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59886 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

Exploit for Command Injection in Grafana

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Py...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: unbound: python3-unbound-1.25.2-0.1.hum1 aarch64, x8664 unbound-1.25.2-0.1.hum1 aarch64, x8664 unbound-anchor-1.25.2-0.1.hum1 aarch64, x8664 unbound-devel-1.25.2-0.1.hum1 aarch64, x8664...

RLSA-2026:40856 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...