CLEANSTART-2026-FW80348 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Security vulnerability affects the httpbin package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: mgr-push: Version 5.2.5-0 Remove token based authentication mechanism for packagepush bsc1230949 spacecmd: Version 5.2.10-0 Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 Version 5.2.9-0 Update translation...

SUSE-SU-2026:4583-1 Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: mgr-push: - Version 5.2.5-0 Remove token based authentication mechanism for packagepush bsc1230949 spacecmd: - Version 5.2.10-0 Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 - Version 5.2.9-0 Update...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: spacecmd was updated to version 5.2.10: Version 5.2.10: Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 Version 5.2.9: Updated translation strings uyuni-tools was updated to version 5.2.17: Security issues...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: spacecmd was updated to version 5.2.10: Version 5.2.10: Pre-filter errata in systemapplyerrata to avoid using API calls for all existing errata bsc1267261 Version 5.2.9: Updated translation strings uyuni-tools was updated to version 5.2.17: Security issues...

PT-2026-108498

Security vulnerability affects the k8s-sidecar package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4061-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4061-1 advisory. Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:4060-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4060-1 advisory. Security issues fixed: - CVE-2026-13346: arbitrary file installation via malicious package indexes bsc1273091. Non security issue...

Security update for python

This update for python fixes the following issues: Security issues fixed: CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl Patch Instructions: To install this SUSE upda...

SUSE-SU-2026:4061-1 Security update for python

This update for python fixes the following issues: Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl...

Security update for python3

This update for python3 fixes the following issues: Security issues fixed: CVE-2026-13346: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl Patch Instructions: To install this SUSE update u...

SUSE-SU-2026:4060-1 Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2026-13346: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl...

SUSE-SU-2026:3969-1 Security update for python

This update for python fixes the following issues: Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl...

Security update for python

This update for python fixes the following issues: Security issues fixed: CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl Patch Instructions: To install this SUSE upda...

openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows...

pip: pip: Arbitrary file installation via malicious package indexes

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-13346: Absolute Path Traversal

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

Security update for opam (important)

openSUSE Security Update: Security update for opam Announcement ID: openSUSE-SU-2026:0250-1 Rating: important References: Cross-References: CVE-2026-57825 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for opam...