AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1776169648)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776169648 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1781346632)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781346632 advisory. - xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc (CENTOS7:CLSA-2026:1786223340)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786223340 advisory. - When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive parsi...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-102269 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-102269 Source advisory: OSV:GHSA-HXM8-2XGR-2P9M...

atlassian-jwt-auth (>=2.7.0, <=3.0.0), credential-shield-fdelgados (>=0.0.1, <=2.0.0) +11 more potentially affected by CVE-2026-102268 via pyjwt (1.4.2)

pyjwt PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.7.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =0.0.1, =0.9.0, =5.4.0, =0.8.0, =0.3.3, =0.4.0 Source cves:...

atlassian-jwt-auth (>=2.0.0, <=2.6.0), clink (>=0.10.0, <=0.23.0) +7 more potentially affected by CVE-2026-102268 via pyjwt (1.4.0)

pyjwt PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.0.0, =0.10.0, =0.0.1.dev1, =0.0.1.dev3, =0.4.0, =3.1.0, =1.1.0, =0.8.0, =0.9.0 Source cves: CVE-2026-102268 Source advisory:...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-102267 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1464 more potentially affected by CVE-2026-102271 via pyjwt (>=2.4.0, <=2.13.0)

pyjwt PYPI version =2.4.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =0.1.1, =0.1.15 - aegis-security-console 2.4.0 and more Source cves: CVE-2026-102271 Source advisory: OSV:GHSA-P4G4-X82P-Q773...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-101917 +1 more via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-101917, CVE-2026-48524 Source advisory:...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102904 Source advisory: SNYK:PYTHON-JUPYTERLAB-20335547...

AZL-105672 CVE-2026-102938 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

AZL-105666 CVE-2026-102937 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

AZL-105675 CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

AZL-105669 CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

UBUNTU-CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102904 Source advisory: MEND:CVE-2026-102904...

Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

CVE-2026-12345

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

vestigium

🔎 Vestigium Agente autônomo de análise forense e CTF. Inge...

CLSA-2026-1790708982 python-jinja2: Fix of CVE-2025-27516

Bump up version to align with Oracle 2.7.2-4.0.1.el7 - CVE-2025-27516: fix sandbox escape via the |attr filter and str.format - Restore str.format automatic field numbering in the sandbox...