60324 matches found
Security update for python-urllib3
This update for python-urllib3 fixes the following issues: CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866. Patch...
SUSE-SU-2026:0367-2 Security update for python-urllib3
This update for python-urllib3 fixes the following issues: - CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. - CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866...
CVE-2026-65908
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...
Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT i...
CVE-2026-65908
JetBrains PyCharm is affected by CVE-2026-65908. In PyCharm before 2026.1.4 (and 2026.2), an attacker could achieve arbitrary code execution by opening a malicious Python executable in an untrusted project. Root cause is likely processing of Python executables on project open; CVSSv3.1 indicates ...
CVE-2026-65908
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...
EUVD-2026-48252
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...
PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...
PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
RHSA-2026:41949 Red Hat Security Advisory: python3.14 security update
Bulletin has no description...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: policycoreutils: policycoreutils-3.11-2.1.hum1 aarch64, x8664 policycoreutils-dbus-3.11-2.1.hum1 noarch policycoreutils-devel-3.11-2.1.hum1 aarch64, x8664 policycoreutils-gui-3.11-2.1.hum1 noarch...
PT-2026-63982
Name of the Vulnerable Software and Affected Versions JetBrains PyCharm versions prior to 2026.1.4 JetBrains PyCharm version 2026.2 Description Opening an untrusted project can lead to arbitrary code execution through the use of a malicious Python executable. Recommendations Update to version...
SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3179-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3179-1 advisory. This update for python-sqlparse fixes the following issue - Fixed a bug where formatting list of tuples leads to denial of service bsc126859...
Oracle Linux 9 : python3.14 (ELSA-2026-41949)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41949 advisory. 3.14.5-1.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193779 Tenable has extracted the preceding description block directly from the Oracle Linux securit...
PT-2026-64164
Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions prior to 1.18.1 Description Improper neutralization of argument delimiters in the install packages method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter...
Fedora 44 : python-black / python-lsp-black / python-pytokens (2026-3805ba3721)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3805ba3721 advisory. Upgrade to 26.5.1, solves serious vulnerabilities such as: CVE-2026-31900 CVE-2026-32274 Tenable has extracted the preceding description block...
GHSA-89VP-JRXV-24W8 JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...
