ROS-20260713-73-0040

The vulnerability in python-dulwich is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-59498

In JazzCore python-pdfkit 1.0.0, the from string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

PT-2026-57606

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system prompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...

PT-2026-60025

Summary web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchain lookup payload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination...

PT-2026-59618

Summary pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception for example by requesting a...

ROS-20260713-73-0026

The vulnerability of the tarfile module in the Python programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

Security update for python-Pillow (important)

openSUSE security update: security update for python-pillow ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21296-1 Rating: important References: bsc1270404 bsc1270409 bsc1270410 bsc1270411 bsc1270412 Cross-References: CVE-2026-42311 CVE-2026-54059...

python313-Django-5.2.16-1.1 on GA media (moderate)

python313-Django-5.2.16-1.1 on GA media Announcement ID: openSUSE-SU-2026:11248-1 Rating: moderate Cross-References: CVE-2015-3982 CVE-2015-5145 CVE-2015-5963 CVE-2016-7401 CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-16984 CVE-2018-6188 CVE-2018-7536 CVE-2018-7537 CVE-2019-11358...

PT-2026-59255

Impact The POST /guardrails/test custom code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. Reaching the endpoint...

ROS-20260713-73-0018

The vulnerability in python-pillow is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-59535

PraisonAI's AST-based Python sandbox can be bypassed using type. getattribute trampoline, allowing arbitrary code execution when running untrusted agent code. Description The execute code direct function in praisonaiagents/tools/python tools.py uses AST filtering to block dangerous Python...

PT-2026-59686

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

ROS-20260713-73-0036

The vulnerability in Python-Relenv relates to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260713-73-0029

The vulnerability in Python-Relenv is related to insufficient resource control during the existence of the resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

PT-2026-59500

Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...

PT-2026-59745

Impact When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. python import tensorflow as tf class QuantConv2DTransposedtf.keras.layers.Layer: def buildself, input shape: self.kernel = self.add weight"kernel", 3, 3,...

ROS-20260713-73-0042

The vulnerability in python-mako is related to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260713-73-0027

The vulnerability of the Python JSON Logger library is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by deploying a specially crafted package...

PT-2026-59655

Impact There are two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases...