752 matches found
wheelaudit
wheelaudit Python Wheel File Security Scanner — scan .whl files for security issues before installation. Motivated by recent CVEs in Python wheel handling: CVE-2026-24049 : Path traversal in wheel unpack allows permission manipulation of system files CVE-2026-1703 : Path traversal when pip instal...
CVE-2026-80589 block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...
CVE-2026-80589 block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...
EUVD-2026-66237
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...
PT-2026-82205
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the block subsystem. The disk release function fails to stop the q-timeout timer when releasing a disk whose probe failed before add disk. This occu...
Astra Linux – Vulnerability in Wheel
A vulnerability was discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier. This vulnerability allows remote attackers to cause a denial of service by using attacker-controlled input to the wheel cli...
SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...
SUSE-SU-2026:3635-1 Security update for python
This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...
SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3601-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3601-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...
Security update for python3
This update for python3 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...
SUSE-SU-2026:3601-1 Security update for python3
This update for python3 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...
CVE-2026-47764
A flaw was found in pdm, a Python package and dependency manager. This vulnerability allows a remote attacker to write arbitrary files to a system by crafting a malicious Python 'wheel' package. The flaw occurs during the installation process, where a critical function responsible for writing fil...
CVE-2026-47764
Summary of CVE-2026-47764 (pdm) : A path-traversal vulnerability in wheel installation arises from InstallDestination.write_to_fs() in src/pdm/installers/installers.py, where a safe validation helper (_path_with_destdir()) was replaced with a bare os.path.join(), removing path validation. Version...
CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
CVE-2026-18481
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...
CVE-2026-18481
CVE-2026-18481 describes a stored cross-site scripting flaw in the AWS Ops Wheel project, affecting the participant_url handling. The issue, triggered by a crafted participant_url value with a dangerous URI scheme, could allow an authenticated remote user to steal session tokens and escalate to f...
CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...
CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...