pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

Nanobrok

Nanobrok Web 服务 用 Python 编写的 Web 服务，用于远程控制和保护您的 Android 设备。 官方应用可在 PlayStore 上找到： NanobrokPro Nanobrok Community 概述 Nanobrok-Server 是一个功能强大的开源 Web 服务，用于控制和保护您的 Android 设备，使用 Python 编写，提供稳定且安全的连接，以远程保护和控制您的 Android 设备。 主要特性 映射设备位置 警报标记（当设备丢失或被盗时） 录音麦克风 远程文件传输 PRO 网络扫描 PRO 以及更多 ！ 安全特性...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

CLEANSTART-2026-CX71098 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

SUSE CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

python313-starlette-1.6.0-1.1 on GA media (moderate)

python313-starlette-1.6.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11626-1 Rating: moderate Cross-References: CVE-2024-47874 CVSS scores: CVE-2024-47874 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-47874 SUSE : 8.7...

Important: python3-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

[SECURITY] Fedora 43 Update: python-django5-5.2.16-1.fc43

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

...

[SECURITY] Fedora 44 Update: python-django5-5.2.16-1.fc44

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 44 Update: python-django6-6.0.5-1.fc44

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

CVE-2026-42874: Improper Neutralization of CRLF Sequences in HTTP Headers

Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.setcookie method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them. This can be a potential source of header injection attacks. For a header injection...

Amazon Linux 2 : python3-tornado, --advisory ALAS2-2025-3109 (ALAS-2025-3109)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3109 advisory. Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied...

[SECURITY] Fedora 42 Update: python-django4.2-4.2.27-1.fc42

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

CVE-2025-67726

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The parseparam function in httputil.py is used to parse specific HTTP header values, such as thos...

CVE-2025-67725

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation...