CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

OPENSUSE-SU-2026:11815-1 python313-ansi2html-1.9.5-1.1 on GA media

These are all security issues fixed in the python313-ansi2html-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed...

EulerOS Virtualization 2.11.0 : python-lxml (EulerOS-SA-2026-3549)

According to the versions of the python-lxml packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the...

CVE-2026-92943

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

SUSE-SU-2026:1117-1 Security update for python311

This update for python311 fixes the following issues: Update to python 3.11.15: - CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. - CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache...

EUVD-2026-82378

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

Guardrails v0.24.1

NVIDIA NeMo Guardrails Library LATEST RELEASE / DEVELOPMENT VERSION : The develop branch tracks the latest top of tree development. The latest released version is 0.24.1. ✨✨✨ 📌 The official NeMo Guardrails library documentation is available atdocs.nvidia.com/nemo/guardrails. ✨✨✨ NVIDIA NeMo...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

GHSA-PQ59-9FQ7-M886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the format and formatmap functions of Python string subclasses. An attacker can access sensitive information by supplying crafted format strings that leverage unrestricted attribute and item access...

EUVD-2026-80780

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution...

GHSA-HP3V-5VW7-FX9W RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

DEBIAN-CVE-2026-85999

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

AZL-103325 CVE-2026-86000 affecting package python-soupsieve 2.6-3

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

CVE-2026-86000

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

EUVD-2026-81690

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

CVE-2026-85999

CVE-2026-85999 affects Soup Sieve , a CSS selector library used with Beautiful Soup 4, in versions prior to 2.9 . The root cause is a polynomial-time (O(n²)) regular expression in RE_WS_END within selector_iter (src/soupsieve/css_parser.py). An end-anchored whitespace-and-comment expression, used...