Important Photon OS Security Update - PHSA-2026-5.0-91-0911

Updates of 'rubygem-faraday', 'python3-urllib3', 'rubygem-nokogiri', 'python3-mistune' packages of Photon OS have been released...

Security update for python-PyJWT (important)

openSUSE security update: security update for python-pyjwt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21095-1 Rating: important References: bsc1266798 bsc1266799 bsc1266800 bsc1266801 bsc1266802 Cross-References: CVE-2026-48522 CVE-2026-48523...

Security update for python-pdm (moderate)

openSUSE security update: security update for python-pdm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21161-1 Rating: moderate References: bsc1268384 bsc1268385 bsc1268386 Cross-References: CVE-2026-47763 CVE-2026-47764 CVE-2026-47781 Affected...

Security update for python-starlette (important)

openSUSE security update: security update for python-starlette ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21053-1 Rating: important References: bsc1268389 bsc1268517 bsc1268520 Cross-References: CVE-2026-48817 CVE-2026-54282 CVE-2026-54283 CVSS...

Critical Photon OS Security Update - PHSA-2026-5.0-0910

Updates of 'python3', 'gnupg' packages of Photon OS have been released...

PT-2026-55181

These are all security issues fixed in the python311-pydata-sphinx-theme-0.19.0-2.1 package on the GA media of openSUSE Tumbleweed...

Important Photon OS Security Update - PHSA-2026-5.0-92-0911

Updates of 'python3-urllib3', 'python3-mistune' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0910

Updates of 'python3' packages of Photon OS have been released...

Security update for python-py7zr (important)

openSUSE security update: security update for python-py7zr ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21159-1 Rating: important References: bsc1268665 bsc1268666 bsc1268669 Cross-References: CVE-2026-23879 CVE-2026-55195 CVE-2026-55206 Affected...

Security update for python-idna (moderate)

openSUSE security update: security update for python-idna ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21048-1 Rating: moderate References: bsc1265413 Cross-References: CVE-2026-45409 CVSS scores: CVE-2026-45409 SUSE : 5.3...

PYSEC-2026-580 Malicious code in coolbox (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of coolbox were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

PYSEC-2026-579 Malicious code in cmd2func (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of cmd2func were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

PYSEC-2026-578 Malicious code in bramin (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of bramin were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

PYSEC-2026-586 Malicious code in tlask (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tlask were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

bofhound (>=0.4.9, <=0.4.25), mseep-mcpexample (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2026-57952 via mythic (>=0.0.38, <=0.2.10)

mythic PYPI version =0.0.38, =0.4.9, =0.1.0, =1.0.1, =1.3.1 Source cves: CVE-2026-57952 Source advisory: SNYK:PYTHON-MYTHIC-17751535...

bofhound (>=0.4.9, <=0.4.25), mseep-mcpexample (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2026-57951 via mythic (>=0.0.38, <=0.2.10)

mythic PYPI version =0.0.38, =0.4.9, =0.1.0, =1.0.1, =1.3.1 Source cves: CVE-2026-57951 Source advisory: SNYK:PYTHON-MYTHIC-17751534...

OPENSUSE-SU-2026:21173-1 Security update for python-pydata-sphinx-theme

This update for python-pydata-sphinx-theme fixes the following issues: Changes in python-pydata-sphinx-theme: - Refresh js dependencies: ws to 7.5.11 bsc1268957, CVE-2026-48779 - Refresh vendored tarball CVE-2026-6321, bsc1264374...

PYSEC-2026-583 Malicious code in nhmpy (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of nhmpy were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

PYSEC-2026-582 Malicious code in mflux-streamlit (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of mflux-streamlit were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

PYSEC-2026-581 Malicious code in dynamo-release (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of dynamo-release were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...