CLSA-2026-1789123062 TuxCare security update for flask-cors (3 CVEs)

TuxCare rebuilt flask-cors to address 3 CVEs. Fixed in 5.0.1.post1+tuxcare...

DEBIAN-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

PYSEC-2026-3969

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

ROOT-APP-PYPI-CVE-2026-41205 CVE-2026-41205 in mako - Patched by Root

Root has patched CVE-2026-41205 in the mako package for Root:PyPI. Multiple fixed versions available...

PYSEC-2026-3805 aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

PYSEC-2026-3920 Snowflake Connector for Python improperly verifies TLS hostnames

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

PYSEC-2026-3814 ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

CLEANSTART-2026-MQ51708 sqlparse is a non-validating SQL parser module for Python

Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

[SECURITY] Fedora 44 Update: GitPython-3.1.62-1.fc44

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

Malicious Package

Overview websetup is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the websetup package...

OPENSUSE-SU-2026:11746-1 python313-modelscope-hub-0.4.2-1.1 on GA media

These are all security issues fixed in the python313-modelscope-hub-0.4.2-1.1 package on the GA media of openSUSE Tumbleweed...

GitPython Argument Injection Unauthorized Access

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

GitPython Code Execution

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.init and isgitdir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository...

Malicious Package

Overview py-devoli-common is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

TencentOS Server 3: python-pyasn1 (TSSA-2026:0990)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0990 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CLSA-2026-1788866911 TuxCare security update for aiohttp (6 CVEs)

TuxCare rebuilt aiohttp to address 6 CVEs. Fixed in 3.8.5.post12+tuxcare...

Scrapegraph-ai v2.2.4

🚀 Looking for an even faster and simpler way to scrape at scale only 5 lines of code? Check out our enhanced version at ScrapeGraphAI.com! 🚀 🕷️ ScrapeGraphAI: You Only Scrape Once English | 中文 | 日本語 | 한국어 | Русский | Türkçe | Deutsch | Español | français | Português | Italiano ScrapeGraphAI is a...