1133 matches found
Malicious code in @years19/n8n-nodes-utils-helper-e (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...
CLSA-2026-1786470220 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post8+tuxcare...
[SECURITY] Fedora 43 Update: python-wsgidav-4.3.5-1.fc43
A generic and extendable WebDAV server written in Python and based on WSGI. Main features: =E2=80=A2 WsgiDAV is a stand-alone WebDAV server with SSL support, that can be installed and run as Python command line script. =E2=80=A2 The python-pam library is needed as extra requirement if pam-login...
Quadratic Behavior in xml.etree.ElementPath Index Predicates
...
CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...
Malicious code in bitcoinlib-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...
CLSA-2026-1780274962 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post9+tuxcare...
PYSEC-2026-3551 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...
MAL-2026-11503 Malicious code in instalogin1234 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...
[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
Dulwich Git Path Traversal
The vulnerability of the Python library for working with Git Dulwich repositories is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
BIT-LIBPYTHON-2026-11972 tarfile opened in streaming mode mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer...
CLEANSTART-2026-YL81211 Security fixes in python3 3.13.8-r0
Package python3 version 3.13.8-r0 fixes 1 vulnerabilities: CVE-2025-8291...
CLEANSTART-2026-DF33306 Security fixes in python3 3.8.8-r0
Package python3 version 3.8.8-r0 fixes 1 vulnerabilities: CVE-2021-23336...
CVE-2026-62995
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...
UBUNTU-CVE-2026-62995
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...
CVE-2026-62995
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...
pysap v0.2.0
pysap - Python library for crafting SAP's network protocols packets Version 0.2.1.dev0 in dev Overview SAP Netweaver and SAP HANA are technology platforms for building and integrating SAP business applications. Communication between components uses different network protocols and some services an...
RockyLinux 8 : python-urllib3 (RLSA-2026:36732)
The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:36732 advisory. urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44431 Tenable has extracted the preceding description...
