1132 matches found
PYSEC-2026-3805 aiosmtplib: STARTTLS response injection
Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...
PYSEC-2026-3920 Snowflake Connector for Python improperly verifies TLS hostnames
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...
PYSEC-2026-3814 ChromaDB has a code injection vulnerability
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...
PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...
CLEANSTART-2026-MQ51708 sqlparse is a non-validating SQL parser module for Python
Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...
[SECURITY] Fedora 44 Update: GitPython-3.1.62-1.fc44
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
Malicious Package
Overview websetup is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the websetup package...
GitPython Code Execution
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
GitPython Argument Injection Unauthorized Access
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
OPENSUSE-SU-2026:11746-1 python313-modelscope-hub-0.4.2-1.1 on GA media
These are all security issues fixed in the python313-modelscope-hub-0.4.2-1.1 package on the GA media of openSUSE Tumbleweed...
Arbitrary Code Injection
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.init and isgitdir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository...
Malicious Package
Overview py-devoli-common is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
TencentOS Server 3: python-pyasn1 (TSSA-2026:0990)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0990 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
CLSA-2026-1788866911 TuxCare security update for aiohttp (6 CVEs)
TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare...
Scrapegraph-ai v2.2.4
🚀 Looking for an even faster and simpler way to scrape at scale only 5 lines of code? Check out our enhanced version at ScrapeGraphAI.com! 🚀 🕷️ ScrapeGraphAI: You Only Scrape Once English | 中文 | 日本語 | 한국어 | Русский | Türkçe | Deutsch | Español | français | Português | Italiano ScrapeGraphAI is a...
[SECURITY] Fedora 43 Update: GitPython-3.1.61-1.fc43
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
ROS-20260908-73-0110
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the lack of measures taken to neutralize special elements during the processing of the unsafegitcloneoptions parameter. Exploiting this vulnerability could allow a remote attacker to execute...
ROS-20260908-73-0109
The vulnerability of the Diffable.diff method in the Python library for interacting with git repositories in GitPython relates to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to re-write any files in the system remotely...