720 matches found
CVE-2026-40260
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has...
[SECURITY] Fedora 43 Update: python-cairosvg-2.9.0-1.fc43
CairoSVG is a SVG 1.1 to PNG, PDF, PS and SVG converter which can also be used as a Python library...
MAL-2026-2671 Malicious code in kryptex-os (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 034201cad27492b279f5c274a5091b2e617da50f27125c7774db069256b3486e Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...
Unity Linux 20.1070e Security Update: python-ldap (UTSA-2026-007085)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007085 advisory. python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, ldap.dn.escapednchars escapes \x00 incorrectly by...
python311-lupa-2.7-1.1 on GA media (moderate)
python311-lupa-2.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10507-1 Rating: moderate Cross-References: CVE-2026-34444 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
Claude SDK For Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a...
CLSA-2026-1775222005 python: Fix of CVE-2025-15367
CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via newlines...
GHSA-W828-4QHX-VXX3 Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a...
Incorrect Permission Assignment for Critical Resource
Overview anthropic is a The official Python library for the anthropic API Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the local filesystem memory tool due to files being created with overly permissive permissions. An attacker can...
GHSA-Q5F5-3GJM-7MFM Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool
The local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read...
MAL-2026-2405 Malicious code in eht-account (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7e1fa4f35985059ad18e3e325fc65e1d25a5692cc9690a4b15af2d76492b95fe Clones of a legitimate library. During processing the private key, it's getting exfiltrated. --- Category: MALICIOUS - The campaign has clearly malicious inten...
CLSA-2026-1775059689 python: Fix of CVE-2025-15367
CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via newlines...
CLSA-2026-1775058454 python: Fix of CVE-2025-15366
CVE-2025-15366: reject control characters in IMAP commands to prevent command injection...
OPENSUSE-SU-2026:10476-1 python311-Pygments-2.20.0-2.1 on GA media
These are all security issues fixed in the python311-Pygments-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-34452
The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then...
CVE-2026-34452
CVE-2026-34452 (Claude SDK for Python) affects the async local filesystem memory tool in the Anthropic Python SDK. From versions 0.86.0 up to before 0.87.0, path validation incorrectly allowed union of model-supplied paths to be validated inside the sandbox but the unresolved path to be used for ...
[SECURITY] Fedora 44 Update: python-pycparser-2.22-8.fc44
pycparser is a complete parser for the C language, written in pure Python. It is a module designed to be easily integrated into applications that need to parse C source code...
Linux Distros Unpatched Vulnerability : CVE-2026-33936
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdD...