PT-2026-99485

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.53 Description Multiple security issues exist in the software. The workflow condition evaluator uses the Python eval function without an effective sandbox, enabling users who can edit workflow branch/condition nodes ...

PT-2026-99484

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.91 Description A sandbox escape exists in the expression engine's DotList map/filter and fallback resolver. Authenticated users can execute arbitrary Python code by crafting workflow expressions that utilize dunder...

CVE-2026-101060: Server-Side Request Forgery (SSRF)

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.calltool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal...

PT-2026-99572

Name of the Vulnerable Software and Affected Versions python-utcp versions prior to 1.1.4 Description An issue exists in the call tool function of the HttpCommunicationProtocol where the initial tool URL is validated, but subsequent HTTP redirects are followed without re-validating the target. Th...

CVE-2026-101058: Server-Side Request Forgery (SSRF)

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-101057: Cleartext Transmission of Sensitive Information

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

CVE-2026-100840: Improper Neutralization of Directives in Dynamically Evaluated Code

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PT-2026-99570

Name of the Vulnerable Software and Affected Versions python-utcp pip package utcp-http versions prior to 1.1.12 Description The software fails to verify if tool URLs in a hand-written UTCP manual point to the agent's own loopback interface when the manual is retrieved from a remote, non-loopback...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow OSS 未认证远程代码执行（RCE） 影响 IBM Langflow OSS 的严重未认证远程代码执行漏洞。 该漏洞源于以下两个弱点的组合利用： 1. /api/v1/autologin 可向未认证的网络调用者签发具有特权的 SUPERUSER Bearer 令牌。 2. /api/v1/validate/code 会在不安全的执行上下文中处理攻击者控制的 Python 代码。 一旦组合利用，这些弱点就可能导致以 Langflow 后端进程的权限执行任意 Python 代码。 该漏洞的 CVSS v3.1 评分为 9.8（严重）...

SUSE CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

SUSE CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

SUSE CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

SUSE CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

SUSE CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

SUSE CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

SUSE CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

MGASA-2026-0455 Updated python3 & python-pip package fixes security vulnerabilities

Please see the references for additional information about vulnerabilities...

Updated python3 & python-pip package fixes security vulnerabilities

Please see the references for additional information about vulnerabilities...

Cyber-Apocalypse

💀 Cyber Apocalypse — شوخی هکری فول‌اسکرین یک برنامه شوخی P...

python-cryptography security update

An update is available for python-cryptography. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programmi...