Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.12: python3.12-3.12.13-3.5.hum1 aarch64, x8664 python3.12-debug-3.12.13-3.5.hum1 aarch64, x8664 python3.12-devel-3.12.13-3.5.hum1 aarch64, x8664 python3.12-idle-3.12.13-3.5.hum1 aarch64,...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

SUSE-SU-2026:2854-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - egression introduced by CVE-2025-66471 fix during file download with pySSL bsc1270365...

better-social-notifications (>=1.0.0, <=20260529145048.0.0.dev0), changedetection-io (>=0.39.18, <=0.60.3) +20 more potentially affected by CVE-2026-59180 via apprise (>=1.0.0, <=1.10.0)

apprise PYPI version =1.0.0, =1.0.0, =0.39.18, =1.0.0, =0.1.0, =0.95.0, =1.3.0, =0.8.0, =0.3.0rc1, =0.0.6, =0.0.25 - proxy-rotator-toolkit 0.0.26 and more Source cves: CVE-2026-59180 Source advisory: SNYK:PYTHON-APPRISE-17950949...

Malicious code in turbocalc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...

MGASA-2026-0240 Updated vim packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Arbitrary Code Execution via Python Omni-Completion in Vim 9.1.1783 && Vim = 9.2.0320 && Vim 9.2.0679. CVE-2026-57454 Out-of-bounds Write in SOFO Soundfolding in Vim 9.2.0698. CVE-2026-57455 Arbitrary Code Execution via Python Omni-Completion...

CVE-2026-61444

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agentsfile parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen...

CVE-2026-61444

PRAISONAi before 4.6.78 has a code‑injection vulnerability in deploy/api.py: the agents_file parameter is interpolated into an f-string without sanitization, allowing arbitrary Python code execution when the generated server code runs via subprocess.Popen(). Affected: PraisonAI

ROOT-APP-PYPI-CVE-2023-6681 CVE-2023-6681 in rootio-jwcrypto - Patched by Root

Root has patched CVE-2023-6681 in the rootio-jwcrypto package for Root:PyPI. Multiple fixed versions available...

Malicious code in sankislayer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74a2d321c0a35b52bc8ba63b8c13dd8e883d63419ed8aa304b648d3599f98ad8 Obfuscated code provides a Telegram bot to join a spamming botnet. Centrally controlled bots can be used to spam other Telegram channels via looped posting,...

Windows Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + ConPTY. Win10 1809+. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayconptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name":...

Multi Python HTTP Polling Beacon

HTTP polling implant with beacon profile jitter, kill date, working hours, cover traffic, optional daisy-chain hop, and Ed25519 implant identity from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.httppollingagent import buildhttppollingagentscript class...

Additive Stream Transform

Adds a repeating key to each byte mod 256. Symmetric encode/decode. Alternative to XOR for signature evasion. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """Additive stream transform - obfuscates C2 traffic by adding key byt...

OPENSUSE-SU-2026:21312-1 Security update for python-pytest-html

This update for python-pytest-html fixes the following issues: Changes in python-pytest-html: - Revendor updating brace-expansion: - force brace-expansion minimum version to fix CVE-2026-13149 bsc1269923...

ROOT-OS-DEBIAN-13-CVE-2026-8328 CVE-2026-8328 in rootio-python3.13 - Patched by Root

Root has patched CVE-2026-8328 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-53511

A flaw was found in calibre, an e-book manager. This vulnerability allows a remote attacker to execute unauthorized code on a user's system. By creating a specially crafted e-book file such as EPUB, OPF, or PDF with malicious metadata, an attacker can trigger the execution of arbitrary Python cod...

SUSE-SU-2026:22624-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length...

SUSE-SU-2026:22589-1 Security update for python-maturin

This update for python-maturin fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270620. -...

SUSE-SU-2026:22615-1 Security update for python-maturin

This update for python-maturin fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270620. -...

ROOT-APP-PYPI-CVE-2026-47707 CVE-2026-47707 in rootio-strawberry-graphql - Patched by Root

Root has patched CVE-2026-47707 in the rootio-strawberry-graphql package for Root:PyPI. Multiple fixed versions available...