CVE-2026-111063: Missing Encryption of Sensitive Data

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4...

ROS-20261019-73-0040

The vulnerability in python-marshmallow relates to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-117520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The pure Python parser in this asynchronous HTTP client/server framework accepts ambiguous HTTP request framing. This allows an unauthenticated attacker to perform request smuggling when an...

RHEL 8 : pcs (RHSA-2026:85135)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85135 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

openSUSE 16 Security Update : python-oauthlib (openSUSE-SU-2026:22103-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22103-1 advisory. - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. -...

AlmaLinux 8 : pcs (ALSA-2026:84798)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggli...

RHEL 8 : pcs (RHSA-2026:84844)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84844 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

openSUSE 16 Security Update : python-virtualenv (openSUSE-SU-2026:22100-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22100-1 advisory. - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt...

mcp-patch-gap-scanner

mcp-patch-gap-scanner Deterministic version-vs-CVE report for...

Siraj Raval Doctor Dignity input validation error vulnerability

Siraj Raval Doctor Dignity has a security vulnerability, which stems from the operation of the modellib parameter in the function getlibmodule in the file python/mlcchat/chatmodule.py. This vulnerability may lead to remote code injection...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

Security update for python-oauthlib (moderate)

openSUSE security update: security update for python-oauthlib ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22103-1 Rating: moderate References: bsc1283526 bsc1283527 Cross-References: CVE-2026-49264 CVE-2026-49265 CVSS scores: CVE-2026-49264 SUSE...

Security update for python-jwcrypto (moderate)

openSUSE security update: security update for python-jwcrypto ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22073-1 Rating: moderate References: bsc1280816 Cross-References: CVE-2026-92091 CVSS scores: CVE-2026-92091 SUSE : 5.3...

Security update for python-tornado6 (important)

openSUSE security update: security update for python-tornado6 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22059-1 Rating: important References: bsc1261922 bsc1277725 bsc1281439 bsc1281440 Cross-References: CVE-2026-82397 CVE-2026-91990...

Security update for python-hpack (moderate)

openSUSE security update: security update for python-hpack ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22070-1 Rating: moderate References: bsc1283035 Cross-References: CVE-2026-59980 CVSS scores: CVE-2026-59980 SUSE : 5.3...

Security update for python-urllib3 (important)

openSUSE security update: security update for python-urllib3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22071-1 Rating: important References: bsc1283908 bsc1283909 bsc1283910 Cross-References: CVE-2026-97687 CVE-2026-97688 CVE-2026-97689 CVSS...

Security update for python-virtualenv (important)

openSUSE security update: security update for python-virtualenv ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22100-1 Rating: important References: bsc1283890 bsc1283904 Cross-References: CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2026-10293...

Security update for python-anyio (important)

openSUSE security update: security update for python-anyio ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22060-1 Rating: important References: bsc1281475 bsc1281476 Cross-References: CVE-2026-63374 CVE-2026-64847 CVSS scores: CVE-2026-63374 SUSE :...

Security update for python-PyJWT (important)

openSUSE security update: security update for python-pyjwt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22074-1 Rating: important References: bsc1283060 bsc1283061 bsc1283064 bsc1283065 bsc1283066 bsc1283067 bsc1283068 bsc1283071 bsc1283072...

MAL-2026-17919 Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...