70048 matches found
PT-2026-59067
Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...
PT-2026-59527
Summary The extractall function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0...
PT-2026-59655
Impact There are two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases...
PT-2026-59660
Summary python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many...
ROS-20260713-73-0026
The vulnerability of the tarfile module in the Python programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
ROS-20260713-73-0020
The vulnerability in python-pillow is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2026-59745
Impact When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. python import tensorflow as tf class QuantConv2DTransposedtf.keras.layers.Layer: def buildself, input shape: self.kernel = self.add weight"kernel", 3, 3,...
ALSA-2026:38510 Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...
Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...
PT-2026-59544
Summary The safe extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and call...
python313-Django-5.2.16-1.1 on GA media (moderate)
python313-Django-5.2.16-1.1 on GA media Announcement ID: openSUSE-SU-2026:11248-1 Rating: moderate Cross-References: CVE-2015-3982 CVE-2015-5145 CVE-2015-5963 CVE-2016-7401 CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-16984 CVE-2018-6188 CVE-2018-7536 CVE-2018-7537 CVE-2019-11358...
Security update for python-Pillow (important)
openSUSE security update: security update for python-pillow ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21296-1 Rating: important References: bsc1270404 bsc1270409 bsc1270410 bsc1270411 bsc1270412 Cross-References: CVE-2026-42311 CVE-2026-54059...
MAL-2026-10215 Malicious code in fast-dotenv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...
vim: Fix of CVE-2026-57456
CVE-2026-57456: use repr to quote python omni-completion doc strings before exec in the Scope/Class/Function getcode of pythoncomplete/python3complete, preventing code execution via a crafted docstring upstream 9.2.0699...
MAL-2026-10196 Malicious code in jupiter-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...
MAL-2026-10194 Malicious code in solidity-dev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...
MAL-2026-10192 Malicious code in defi-tools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a2562ad49633ee8c845db08a485394cb31c7de12d9f87eb3f8ef0ab61fb5128 On first import, defitools/init.py decodes a base64-embedded 486KB Linux ELF, writes it to /.config/.npm-cache/snapd-network, sets mode 0777, and...
Malicious code in data-harvester (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c2e2c21d9afac9277d95589962d33a09651a5b6ef7e0b3c9e07aee56af213f On first import, dataharvester/init.py decodes a base64-embedded 486KB Linux ELF, writes it to /.config/.npm-cache/snapd-network, sets mode 0777, and...
