GO-2026-5800 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.Volume,VolumeSnapshots,Pool in github.com/lxc/incus...

PYSEC-2026-1244 ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

Summary ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the getresponse method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service...

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

SummaryChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the getresponse method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service...

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

urllib3 handles redirects and retries using the same mechanism, which is controlled by the Retry object. The most common way to disable redirects is at the request level, as follows:pythonresp = urllib3.request"GET", "https://httpbin.org/redirect/1", redirect=Falseprintresp.status 302However, it ...

PYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

urllib3 handles redirects and retries using the same mechanism, which is controlled by the Retry object. The most common way to disable redirects is at the request level, as follows: python resp = urllib3.request"GET", "https://httpbin.org/redirect/1", redirect=False printresp.status 302 However,...

django-database-conn-pool (>=1.1.0, <=1.1.1), django-learngual (>=0.39.0, <=0.895.0) +2 more potentially affected by CVE-2026-48588 via django (4.0.8)

django PYPI version 4.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-database-conn-pool =1.1.0, =0.39.0, =0.11.21, =0.50.3 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-database-conn-pool (>=1.1.0, <=1.1.1), django-learngual (>=0.39.0, <=0.895.0) +2 more potentially affected by CVE-2026-53877 via django (4.0.8)

django PYPI version 4.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-database-conn-pool =1.1.0, =0.39.0, =0.11.21, =0.50.3 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

SUSE CVE-2026-6734

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This caus...

PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False

When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later. This occurs because the underlying connection is reused...

Requests `Session` object does not verify requests after making first request with verify=False

When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later.This occurs because the underlying connection is reused...

FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

ImpactAn input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. PatchesWe have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48.The fix will be included in TensorFlow 2.11.0. We will also cherry...

PYSEC-2026-1049 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

Impact An input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cher...

PYSEC-2026-984 `FractionalMaxPoolGrad` Heap out of bounds read

Impact If FractionMaxPoolGrad is given outsize inputs rowpoolingsequence and colpoolingsequence, TensorFlow will crash. python import tensorflow as tf tf.rawops.FractionMaxPoolGrad originput = 1, 1, 1, 1, 1, origoutput = 1, 1, 1, outbackprop = 3, 3, 6, rowpoolingsequence = -0x4000000, 1, 1,...

`FractionalMaxPoolGrad` Heap out of bounds read

ImpactIf FractionMaxPoolGrad is given outsize inputs rowpoolingsequence and colpoolingsequence, TensorFlow will crash.pythonimport tensorflow as tftf.rawops.FractionMaxPoolGrad originput = 1, 1, 1, 1, 1, origoutput = 1, 1, 1, outbackprop = 3, 3, 6, rowpoolingsequence = -0x4000000, 1, 1,...

TensorFlow vulnerable to `CHECK` fail in `AvgPoolGrad`

ImpactThe implementation of AvgPoolGrad does not fully validate the input originputshape. This results in a CHECK failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfksize = 1, 2, 2, 1strides = 1, 2, 2, 1padding = "VALID"dataformat = "NHWC"originputshape =...

TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad`

ImpactFractionalMaxPoolGrad validates its inputs with CHECK failures instead of with returning errors. If it gets incorrectly sized inputs, the CHECK failure can be used to trigger a denial of service attack:pythonimport tensorflow as tfoverlapping = Trueoriginput = tf.constant.453409232,...

TensorFlow vulnerable to `CHECK` failures in `FractionalAvgPoolGrad`

ImpactThe implementation of FractionalAvgPoolGrad does not fully validate the input originputtensorshape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack.pythonimport tensorflow as tfoverlapping = Trueoriginputtensorshape =...

PYSEC-2026-969 TensorFlow vulnerable to `CHECK` failures in `FractionalAvgPoolGrad`

Impact The implementation of FractionalAvgPoolGrad does not fully validate the input originputtensorshape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack. python import tensorflow as tf overlapping = True originputtensorshape =...

PYSEC-2026-949 TensorFlow vulnerable to segfault in `QuantizedAvgPool`

Impact If QuantizedAvgPool is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf ksize = 1, 2, 2, 1 strides = 1, 2, 2, 1 padding = "SAME" input = tf.constant1, shape=1,4,4,2,...

PYSEC-2026-1019 TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

Impact The AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program. python import tensorflow as tf import numpy as np value = np.ones1, 1, 1, 1 ksize = 1, 1e20, 1, 1 strides = 1, 1, 1, 1 padding = 'SAM...