PT-2026-56794

Name of the Vulnerable Software and Affected Versions Xerte Online Tools affected versions not specified Description A flaw in the tools server settings allows for Remote Code Execution RCE. An attacker can modify the antivirus binary path to point to a PHP interpreter, enabling the upload and...

Xerte Online Toolkit contains an authentication bypass that allows for RCE

Overview Two vulnerabilities have been discovered in Xerte Online Toolkits, an open-source e-learning authoring toolsuite intended for the creation of learning materials within a web browser. CVE-2026-14261 tracks the persistence of the /setup/ directory after installation, which allows an...

CVE-2026-12116: Undefined Security Weakness

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

ROS-20260708-73-0035

The vulnerability of Redis’ Lua interpreter for database management systems involves the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DSPy does not properly restrict file reads

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class...

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

ImpactVia a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython.It has been fixed for some Python versions. PatchesPatched...

Security Bulletin: Arbitrary Code Execution in Python Interpreter Component

Summary A vulnerability in the Python Interpreter component allowed authenticated users to execute arbitrary Python code and escalate privileges to superuser level. An attacker with valid credentials could bypass security controls through the PythonREPLComponent, directly access the database, and...

SUSE SLES15 Security Update : python311 (SUSE-SU-2026:2723-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2723-1 advisory. Security issues fixed: - CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be...

Security update for python311

This update for python311 fixes the following issues: Security issues fixed: CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed bsc1261970. Other updates and bugfixes: Rewrite structure of Python interpreter packages. python3...

EUVD-2025-210391

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load...

The vulnerability of the checkstackGC() function in the Lua script interpreter allows a attacker to trigger a service failure.

The vulnerability of the checkstackGC function in the Lua script interpreter is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the code.InteractiveInterpreter process in reduce methods. An attacker can execute arbitrary code by...

CVE-2025-71371

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load...

CVE-2025-71371

CVE-2025-71371 affects picklescan

CVE-2025-71371 picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load...

CVE-2025-71371 picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load...

PT-2026-54011

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description The software fails to detect malicious pickle files that utilize the code.InteractiveInterpreter.runcode function within reduce methods. This allows attackers to craft pickle payloads that bypass...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : crypto: algifaead - Revert to operating out-of-placeCVE-2026-31431 bpf: Fix undefined behavior in interpreter sdiv/smod for INTMINCVE-2026-31525...

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Summary js-toml's interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is silently overwritten by a...

GHSA-M34P-749J-X6M6 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Summary js-toml's interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is silently overwritten by a...