Fedora 44 : python-httpx2 (2026-a69588e2cd)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a69588e2cd advisory. Update httpcore2 and httpx2 to 2.13.1. This is a security fix for CVE-2026-84378, CVE-2026-84379, and CVE-2026-84380. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-94634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This...

Fedora 43 : buildstream (2026-e14ea5695c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e14ea5695c advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

Fedora 44 : python-cssselect2 / weasyprint (2026-309c4b78a1)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-309c4b78a1 advisory. Update to latest upstream version of WeasyPrint and python-cssselect2. This update fixes CVE-2026-55073 Server-Side Request Forgery Tenable has extracted the...

SUSE SLED15 / SLES15 Security Update : python-anyio (SUSE-SU-2026:4416-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4416-1 advisory. - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873

The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

aiidalab (>=24.7.0, <=26.10.0), aiidalab-dlpoly (>=0.1.0, <=0.2.0) +47 more potentially affected by CVE-2026-114094 via dulwich (0.25.2)

dulwich PYPI version 0.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - aiidalab =24.7.0, =0.1.0, =0.1.0, =1.3.4, =0.2.1, =0.5.1, =0.3.0, =3.1.0, =3.56.0, =0.0.10.dev4, =0.1.1 and more Source cves: CVE-2026-114094...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +33 more potentially affected by CVE-2026-114095 via dulwich (0.22.8)

dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...

anji-common-addons (>=0.3.0, <=0.3.2), anji-core (>=0.8.3, <=0.8.11) +9 more potentially affected by CVE-2026-114095 via dulwich (>=1.0.0, <=1.2.6)

dulwich PYPI version =1.0.0, =0.3.0, =0.8.3, =1.10.0, =0.3.1, =5.30.0, =5.30.0, =0.1.9, =0.2.1 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

aiidalab (>=22.6.0, <=26.10.0), aiidalab-dlpoly (>=0.1.0, <=0.2.0) +110 more potentially affected by unknown CVE via dulwich (>=0.23.1, <=1.2.6)

dulwich PYPI version =0.23.1, =22.6.0, =0.1.0, =0.1.0, =1.3.4, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.3.0, =0.8.3, =0.1.0, =0.1.6 and more Source cves: unknown CVE Source advisory: GHSA-5FQC-MRG8-W798...

DEBIAN-CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

UBUNTU-CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104843

A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place maliciou...

SUSE CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

SUSE CVE-2026-94634

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...