Apache BuildStream 2.8.0 (symlink) Arbitrary File Write

Summary BuildStream is a powerful software integration tool that allows developers to automate the integration of software components including operating systems, and to streamline the software development and production process. Description Apache BuildStream's tar source plugin extracts archive...

CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-96749: Integer Overflow or Wraparound

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

Security update for python-GitPython (important)

openSUSE security update: security update for python-gitpython ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21874-1 Rating: important References: bsc1273357 bsc1273358 bsc1273359 bsc1273364 bsc1273414 bsc1273498 bsc1275745 bsc1275746 bsc1275747...

CVE-2026-57175: Improper Authentication

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

CVE-2026-57177: Cross-Site Request Forgery (CSRF)

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-96747: Server-Side Request Forgery (SSRF)

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-57179: Session Fixation

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

ALSA-2026:71658 Important: python-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-98191

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The partial-pipeline resume mechanism accepts the partial token as a bearer credential without binding it to the browser session that created it. This allows an attacker to initiate an...

PT-2026-98188

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The Vend OAuth2 backend uses only the numeric user id as the social-auth UID. In applications where multiple Vend shops authenticate, users from different shops who share the same internal...

PT-2026-98233

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description An integer overflow exists in the BSON document encoding component of the bundled native extension. This occurs when a single document is constructed using an excessively large...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

DEBIAN-CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

UBUNTU-CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980

A flaw was found in hpack, an HTTP/2 Header Encoding for Python. Unbounded variable integer decoding can lead to excessive computation when processing specially crafted, malformed input. A remote attacker could exploit this vulnerability to cause a denial of service by effectively blocking furthe...