Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps...

SUSE-SU-2026:22495-1 Security update for python-mistune

This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091...

OPENSUSE-SU-2026:21191-1 Security update for python-mistune

This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091...

[SECURITY] Fedora 43 Update: python-pydantic-settings-2.14.2-1.fc43

Settings management using pydantic...

PT-2026-53361

An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...

python3.12-urllib3 security update

1.26.19-3 - Security fixes for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-185125, RHEL-184900...

PT-2026-53404

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust remote code set to true in...

RHEL 8 : python3.12-urllib3 (RHSA-2026:32992)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:32992 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

AlmaLinux 8 : python3.12-urllib3 (ALSA-2026:32992)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:32992 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

OPENSUSE-SU-2026:11148-1 python311-pydata-sphinx-theme-0.19.0-1.1 on GA media

These are all security issues fixed in the python311-pydata-sphinx-theme-0.19.0-1.1 package on the GA media of openSUSE Tumbleweed...

ALSA-2026:32992 Important: python3.12-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python3.12-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python311-jupyter-ydoc-3.5.0-1.1 on GA media (moderate)

python311-jupyter-ydoc-3.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11137-1 Rating: moderate Cross-References: CVE-2026-48779 CVSS scores: CVE-2026-48779 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-48779 SUSE : 7.1...

PT-2026-53938

Name of the Vulnerable Software and Affected Versions python313-lxml html clean versions prior to 0.4.5-1.1 python-lxml-doc versions prior to 6.1.1-1.1 Description Security issues were identified in the python313-lxml html clean and python-lxml-doc packages. Recommendations Update python313-lxml...

OPENSUSE-SU-2026:11147-1 python-lxml-doc-6.1.1-1.1 on GA media

These are all security issues fixed in the python-lxml-doc-6.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

python security update

2.7.5-94.0.9 - Fix for CVE-2026-4786 Orabug: 39418723 2.7.5-94.0.7 - Fix for CVE-2026-4519 Orabug: 39243798 2.7.5-94.0.5 - Fix for CVE-2025-15366 and CVE-2025-15367 Orabug: 39114639 2.7.5-94.0.3 - Fix for CVE-2025-12084 Orabug: 38902314...

PT-2026-53614

OpenStack Object Storage swift before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object...

PT-2026-53636

Impacted Environments This issue ONLY impacts environments using the PyNcclPipe KV cache transfer integration with the V0 engine. No other configurations are affected. Summary vLLM supports the use of the PyNcclPipe class to establish a peer-to-peer communication domain for data transmission...

Malicious code in tdata-grabber (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4c3b37df5e3d08d7bc6ad736e0231ed0dc655640ffdf0dc403f4029ace2787 Package name explicitly declares its purpose as harvesting Telegram Desktop session data tdata directory. The tdata folder contains live authenticate...

MAL-2026-6560 Malicious code in tdata-grabber (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4c3b37df5e3d08d7bc6ad736e0231ed0dc655640ffdf0dc403f4029ace2787 Package name explicitly declares its purpose as harvesting Telegram Desktop session data tdata directory. The tdata folder contains live authenticate...