CVE-2026-101917

The PyJWT library (versions prior to 2.14.0 ) is vulnerable because the get_signing_key_from_jwt function lacks a negative cache or minimum refresh interval for unknown kid values. This allows an attacker to send unauthenticated tokens with unknown or varying kid values, forcing PyJWKClient to re...

CVE-2026-101861

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious repr method into component input options lists. The eval sink is triggered when a...

ROOT-APP-PYPI-CVE-2024-5569 CVE-2024-5569 in zipp - Patched by Root

Root has patched CVE-2024-5569 in the zipp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-101861 Langflow Code Execution via eval() in Component Input Schema

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious repr method into component input options lists. The eval sink is triggered when a...

Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS...

SUSE-SU-2026:4365-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. - CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a...

Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware...

ROOT-APP-PYPI-CVE-2026-24049 CVE-2026-24049 in setuptools - Patched by Root

Root has patched CVE-2026-24049 in the setuptools package for Root:PyPI. Multiple fixed versions available...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in Apache Thrift (CVE-2026-41608, CVE-2026-66053)

Summary Multiple Denial of Service vulnerabilities in Apache Thrift CVE-2026-41608, CVE-2026-66053 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.24.0. Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540)

Summary Multiple Denial of Service and resource exhaustion vulnerabilities in the python-multipart parser library CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32...

CVE-2026-84655

A flaw was found in Jenkins. When serializing objects as JSON and Python through its REST API, Jenkins does not properly escape map keys. This allows an attacker who can control map property names to inject arbitrary fields into JSON and Python API responses, potentially leading to information...

proofcms

ProofCMS ProofCMS is a modular Python toolkit for detecting c...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

Authlib library contains a signature‑verification bypass vulnerability

Overview Authlib versions up to and including 1.7.2 contain a signature‑verification bypass in the JSON Web Signature JWS general JSON serialization handling. The JsonWebSignature.deserializejson function accepts a JWS object with an empty "signatures" array and treats the payload as successfully...

The vulnerability of the pyasn1 library in the Python programming language, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the pyasn1 library in the Python programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...